CVE-2023-7299

CriticalCVSS 9.8/10Last modified Sep 3, 2026

Description

A vulnerability was found in DataGear up to 4.60. It has been declared as critical. This vulnerability affects unknown code of the file /dataSet/resolveSql. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. Upgrading to version 4.7.0 is able to address this issue. It is recommended to upgrade the affected component.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
n/a	DataGear	4.0; 4.1; 4.2; 4.3; 4.4; 4.5; 4.6; 4.7; 4.8; 4.9; 4.10; 4.11; 4.12; 4.13; 4.14; 4.15; 4.16; 4.17; 4.18; 4.19

References

https://github.com/datageartech/datagear/issues/29Exploit
https://vuldb.com/?ctiid.285658Permissions Required
https://vuldb.com/?id.285658Third Party Advisory
https://vuldb.com/?submit.442943Third Party Advisory

Timeline

Published: Nov 23, 2024
Last modified: Sep 3, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-73008.0Huawei Home Music System has a path traversal vulnerability. Successful exploitation of this vulnerability may cause the music host file to CVE-2023-73033.5A vulnerability, which was classified as problematic, was found in q2apro q2apro-on-site-notifications up to 1.4.6. This affects the functio CVE-2023-73049.3Ruijie RG-UAC Application Management Gateway contains a command injection vulnerability via the 'nmc_sync.php' interface. An unauthenticated CVE-2023-73059.2SmartBI V8, V9, and V10 contain an unrestricted file upload vulnerability via the RMIServlet request handling logic. Under certain configura CVE-2023-73067.5The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wp CVE-2023-73078.7Sangfor Behavior Management System (also referred to as DC Management System in Chinese-language documentation) contains an XML external ent CVE-2023-73087.5SecGate3600, a network firewall product developed by NSFOCUS, contains a sensitive information disclosure vulnerability in the /cgi-bin/auth CVE-2023-730910.0A path traversal vulnerability exists in the Dahua Smart Park Integrated Management Platform (also referred to as the Dahua Smart Campus Int CVE-2023-73119.3BYTEVALUE Intelligent Flow Control Router contains a command injection vulnerability via the /goform/webRead/open endpoint. The `path` param CVE-2023-73124.8Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability when adding or configuring Email Settings. U CVE-2023-73135.4Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bulk Modifications tool. Insufficient validation or CVE-2023-73145.4Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bandwidth Report component. Insufficient validation