PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-5045 Biltay Technology CVE debrief

CVE-2023-5045 is a critical SQL injection issue in Biltay Kayisi affecting versions before 1286. The published description states that improper neutralization of SQL command special elements could allow SQL injection and may also lead to command line execution through SQL injection. NVD lists the issue as network-reachable, unauthenticated, and high impact across confidentiality, integrity, and availability.

Vendor
Biltay Technology
Product
Kayisi
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2023-10-12
Original CVE updated
2026-05-21
Advisory published
2023-10-12
Advisory updated
2026-05-21

Who should care

Administrators, operators, and security teams responsible for Biltay Kayisi deployments before version 1286 should treat this as urgent. Any environment exposing the affected application to untrusted input or external users should prioritize remediation.

Technical summary

The NVD record maps the weakness to CWE-89 and assigns CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting easy remote exploitation without privileges or user interaction. The affected CPE range is biltay:kayisi versions prior to 1286. The source advisory and NVD entry both characterize the issue as an SQL injection vulnerability, with the source description additionally noting potential command line execution through SQL injection.

Defensive priority

Critical. Remediate immediately by upgrading to a fixed version and validating exposure. Because the vulnerability is network-accessible and requires no authentication or user interaction, it should be handled as a high-priority patching item.

Recommended defensive actions

  • Upgrade Biltay Kayisi to version 1286 or later.
  • Confirm which systems run affected Kayisi versions and prioritize any internet-facing or broadly accessible deployments.
  • Review the USOM advisory and the NVD record for any vendor-specific remediation guidance.
  • Check application logs and database access logs for signs of abnormal query behavior around the exposure period.
  • After upgrading, validate that the deployed version is no longer within the affected range.

Evidence notes

This debrief is based on the official NVD record, the CVE record, and the linked USOM advisory sources supplied in the corpus. The vulnerability description, affected version boundary, CVSS vector, and CWE-89 mapping come from the provided NVD metadata and source description. No KEV entry was supplied for this CVE.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-5045 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-5045

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-5045 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-5045

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.