CVE-2023-27167

MediumCVSS 6.5/10Last modified Jul 9, 2026

Description

Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/absence?search_month=1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://biostar2.ciklum.net/api/users/absence?search_month=1Broken Link
https://packetstormsecurity.com/files/171523/Suprema-BioStar-2-2.8.16-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://protey.net/threads/cve-2023-27167-suprema-biostar-2-v2-8-16-sql-injection.995/Exploit, Third Party Advisory
https://www.linkedin.com/in/yuriy-tsarenko-a1453aa4/Permissions Required
https://biostar2.ciklum.net/api/users/absence?search_month=1Broken Link
https://packetstormsecurity.com/files/171523/Suprema-BioStar-2-2.8.16-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://protey.net/threads/cve-2023-27167-suprema-biostar-2-v2-8-16-sql-injection.995/Exploit, Third Party Advisory
https://www.linkedin.com/in/yuriy-tsarenko-a1453aa4/Permissions Required

Timeline

Published: Mar 29, 2023
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-271689.8An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to execute arbitrary code via a crafted jsp fi CVE-2023-271696.5Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in license class configuration which leads to the generation of a hardcoded and pre CVE-2023-27174.3The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to mi CVE-2023-271707.5Xpand IT Write-back manager v2.3.1 allows attackers to perform a directory traversal via modification of the siteName parameter.CVE-2023-271729.1Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. This allows attackers to easily obtain the secret key used to s CVE-2023-271789.8An arbitrary file upload vulnerability in the upload function of GDidees CMS 3.9.1 allows attackers to execute arbitrary code via a crafted CVE-2023-271797.5GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdow CVE-2023-27185.4The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stor CVE-2023-271807.5GDidees CMS v3.9.1 was discovered to contain a source code disclosure vulnerability by the backup feature which is accessible via /_admin/ba CVE-2023-27198.8The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before CVE-2023-271917.5An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files.CVE-2023-271929.8An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the key_wifi_safe_net_check_url, KEY_