CVE-2023-3449

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability has been found in IBOS OA 4.5.5 and classified as critical. This vulnerability affects the function actionExport of the file ?r=recruit/interview/export&interviews=x of the component Interview Management Export. The manipulation of the argument interviews leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-232546 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
IBOS	OA	4.5.5

References

https://github.com/MinimoAgoni/cve/blob/main/iboa%20oa.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.232546Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.232546Permissions Required, Third Party Advisory, VDB Entry
https://github.com/MinimoAgoni/cve/blob/main/iboa%20oa.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.232546Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.232546Permissions Required, Third Party Advisory, VDB Entry

Timeline

Published: Jun 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-344947.5NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c.CVE-2023-34507.2A vulnerability was found in Ruijie RG-BCR860 2.5.13 and classified as critical. This issue affects some unknown processing of the component CVE-2023-34529.8The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter CVE-2023-34538.1ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with ad CVE-2023-345375.4A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to CVE-2023-34549.8Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary cod CVE-2023-345409.8Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIR CVE-2023-345419.8Langchain 0.0.171 is vulnerable to Arbitrary code execution in load_prompt.CVE-2023-345459.8A SQL injection vulnerability in CSZCMS 1.3.0 allows remote attackers to run arbitrary SQL commands via p parameter or the search URL.CVE-2023-345489.8Simple Customer Relationship Management 1.0 is vulnerable to SQL Injection via the email parameter.CVE-2023-34559.1Key management vulnerability on system. Successful exploitation of this vulnerability may affect service availability and integrity.CVE-2023-345518.0In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK command server can allow an authentic