PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-2750 Cityboss CVE debrief

CVE-2023-2750 is a critical SQL injection flaw in Cityboss E-Municipality affecting versions before 6.05. NVD rates it 9.8/CRITICAL, and the vulnerability is recorded with a CWE-89 weakness classification. Because the issue is network-exploitable with no user interaction and no privileges required, exposed deployments should be treated as high risk until patched. The CVE was published on 2023-05-24 and later modified on 2024-11-21.

Vendor
Cityboss
Product
E-municipality
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2023-05-24
Original CVE updated
2024-11-21
Advisory published
2023-05-24
Advisory updated
2024-11-21

Who should care

Administrators and security teams responsible for Cityboss E-Municipality deployments, especially any internet-facing or externally reachable instances running a version earlier than 6.05.

Technical summary

The NVD record describes an improper neutralization of special elements used in an SQL command, i.e. SQL injection. The affected CPE is Cityboss E-Municipality versions before 6.05. The CVSS vector shown by NVD is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a remotely reachable issue with no privileges or user interaction required and potential impact to confidentiality, integrity, and availability. NVD also links a third-party advisory from USOM (TR-23-0286).

Defensive priority

Urgent. This is a critical remote SQL injection issue with broad potential impact and should be prioritized for immediate patching or isolation if upgrade cannot be performed quickly.

Recommended defensive actions

  • Upgrade Cityboss E-Municipality to version 6.05 or later, which is the first version not listed as affected.
  • If immediate patching is not possible, restrict network exposure to the application and limit access to trusted administrative networks only.
  • Review application and database logs for abnormal query patterns or unexpected database activity around the affected service.
  • Verify whether any Internet-facing instances are running a version earlier than 6.05 and inventory them for expedited remediation.
  • Use the USOM advisory and the NVD record to confirm the latest vendor and third-party guidance before scheduling maintenance.

Evidence notes

All claims here are limited to the supplied NVD record and the linked USOM advisory. The record identifies Cityboss E-Municipality as the affected product, notes versions before 6.05 as vulnerable, classifies the weakness as CWE-89, and assigns a 9.8 CVSS score with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVE publishedAt date is 2023-05-24T12:15:09.337Z and modifiedAt is 2024-11-21T07:59:13.250Z.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-2750 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-2750

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-2750 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-2750

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.