CVE-2023-48645

An issue was discovered in the Archibus app 4.0.3 for iOS. It uses a local database that is synchronized with a Web central server instance every time the application is opened, or when the refresh button is used. There is a SQL injection in the search work request feature in the Maintenance module of the app. This allows performing queries on the local database.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48645
https://excellium-services.com/cert-xlm-advisory/CVE-2023-48645	Third Party Advisory
https://excellium-services.com/cert-xlm-advisory/CVE-2023-48645	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:eptura:archibus:4.0.3:*:*:*:iphone_os:*:*:*

History

03 Jun 2025, 03:15

Type	Values Removed	Values Added
References		() https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48645 -

Information

Published : 2024-02-02 09:15

Updated : 2025-06-03 03:15

NVD link : CVE-2023-48645

Mitre link : CVE-2023-48645

CVE.ORG link : CVE-2023-48645

JSON object : View

Products Affected

eptura

archibus

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2023-48645", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-02-02T09:15:37.420", "references": [{"url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-48645", "source": "cve@mitre.org"}, {"url": "https://excellium-services.com/cert-xlm-advisory/CVE-2023-48645", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://excellium-services.com/cert-xlm-advisory/CVE-2023-48645", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the Archibus app 4.0.3 for iOS. It uses a local database that is synchronized with a Web central server instance every time the application is opened, or when the refresh button is used. There is a SQL injection in the search work request feature in the Maintenance module of the app. This allows performing queries on the local database."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en la aplicaci\u00f3n Archibus 4.0.3 para iOS. Utiliza una base de datos local que se sincroniza con una instancia del servidor central web cada vez que se abre la aplicaci\u00f3n o cuando se utiliza el bot\u00f3n de actualizaci\u00f3n. Hay una inyecci\u00f3n de SQL en la funci\u00f3n de b\u00fasqueda de solicitudes de trabajo en el m\u00f3dulo de Mantenimiento de la aplicaci\u00f3n. Esto permite realizar consultas en la base de datos local."}], "lastModified": "2025-06-03T03:15:24.817", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eptura:archibus:4.0.3:*:*:*:iphone_os:*:*:*", "vulnerable": true, "matchCriteriaId": "9D2C0C7F-FDE0-4372-A750-16E68CAC7D73"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}