PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-35066 Infodrom Software CVE debrief

CVE-2023-35066 is a critical SQL injection vulnerability in Infodrom's E-Invoice Approval System affecting versions before v.20230701. The issue was published on 2023-07-25 and is mapped to CWE-89, with NVD listing a CVSS 3.1 vector of network-accessible, no-authentication, no-user-interaction impact rated 9.8 Critical.

Vendor
Infodrom Software
Product
E-Invoice Approval System
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2023-07-25
Original CVE updated
2024-11-21
Advisory published
2023-07-25
Advisory updated
2024-11-21

Who should care

Organizations running Infodrom E-Invoice Approval System versions earlier than v.20230701 should treat this as high priority, especially teams responsible for exposed application servers, database-backed approval workflows, and patch management.

Technical summary

The NVD record identifies an SQL injection weakness in Infodrom E-Invoice Approval System with a vulnerable version range ending before 20230701. The reported CVSS vector indicates the flaw is reachable over the network without privileges or user interaction, and the impact is rated high for confidentiality, integrity, and availability.

Defensive priority

Critical. Prioritize remediation promptly because the vulnerability is remotely reachable, requires no authentication, and is scored 9.8/10.

Recommended defensive actions

  • Upgrade Infodrom E-Invoice Approval System to v.20230701 or later.
  • Inventory all instances of the product, including test, staging, and customer-facing deployments.
  • Review application and database logs for anomalous query patterns or unexpected error spikes around exposed endpoints.
  • Restrict exposure of the application where possible until patching is complete.
  • Validate that any compensating controls and WAF rules do not rely on assumptions about user authentication for this application.

Evidence notes

The supplied NVD metadata marks the product as vulnerable before v.20230701 and assigns CWE-89. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, supporting a severe remotely reachable impact profile. A third-party advisory reference from USOM is included in the source record.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-35066 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-35066

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-35066 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-35066

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.