CVE-2023-33410

Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on the Customer Name field in the Accounting module that is used to construct a CSV file.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

1.16% chance of exploitation in the next 30 days, 65th percentile

Published

2023-06-05

Updated

2025-01-08

Proof-of-concept exploits (1)

• Thirukrishnan/CVE-2023-334100★ · 2023-06-02

References

• CVE Record
• NVD entry

Related

• CVE-2023-33408
• CVE-2023-33409
• CVE-2023-50164
• CVE-2024-27665
• CVE-2023-33439
• CVE-2023-3344