CVE-2023-2889

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veon Computer Service Tracking Software allows SQL Injection.

This issue affects Service Tracking Software: before crm 2.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Veon Computer	Service Tracking Software	< crm 2.0

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0653
https://www.usom.gov.tr/bildirim/tr-23-0653Third Party Advisory
https://www.usom.gov.tr/bildirim/tr-23-0653Third Party Advisory

Timeline

Published: Nov 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-288927.8Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleaner_Debug.lo CVE-2023-288956.8The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. CVE-2023-288962.4Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controll CVE-2023-288979.8The secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware. Vulnerability discovered o CVE-2023-288985.3The Real-Time Streaming Protocol implementation in the MIB3 infotainment incorrectly handles requests to /logs URI, when the id parameter eq CVE-2023-288995.5By sending a specific reset UDS request via OBDII port of Skoda vehicles, it is possible to cause vehicle engine shutdown and denial of serv CVE-2023-289005.3The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing to obtain nicknames and other user identifiers of Skoda CVE-2023-289015.3The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing remote attackers to obtain recent trip data, vehicle mil CVE-2023-289023.3An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cau CVE-2023-289033.3An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to caus CVE-2023-289045.2A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical acc CVE-2023-289058.0A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it. The