PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-2045 Ipekyolunet CVE debrief

CVE-2023-2045 is a critical SQL injection vulnerability in Ipekyolu Software Auto Damage Tracking Software affecting versions before 4. The issue is rated 9.8 and can allow an attacker to impact confidentiality, integrity, and availability over the network without authentication.

Vendor
Ipekyolunet
Product
Software Auto Damage Tracking Software
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2023-05-24
Original CVE updated
2024-11-21
Advisory published
2023-05-24
Advisory updated
2024-11-21

Who should care

Security teams, application owners, and administrators running Ipekyolu Software Auto Damage Tracking Software before version 4 should prioritize this issue. It is especially relevant for internet-facing or broadly reachable deployments, given the network attack vector and unauthenticated impact described in the CVSS record.

Technical summary

NVD describes CVE-2023-2045 as an SQL injection weakness (CWE-89) in Ipekyolu Software Auto Damage Tracking Software, with vulnerable versions listed as before 4. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating low-complexity remote exploitation with no privileges or user interaction required and high impact if successful. The supplied NVD record includes a third-party advisory from USOM as a reference.

Defensive priority

Urgent. Treat as a high-priority remediation item for any environment using affected versions, especially if the application is reachable from untrusted networks.

Recommended defensive actions

  • Identify all installations of Ipekyolu Software Auto Damage Tracking Software and confirm the exact version in use.
  • Upgrade to version 4 or later, since the NVD CPE range marks versions before 4 as vulnerable.
  • If immediate upgrading is not possible, reduce exposure by limiting network access to the application and placing it behind appropriate access controls.
  • Review application and database logs for anomalous requests or unexpected query behavior around the affected service.
  • Validate mitigation or vendor guidance published through the referenced USOM advisory and track any follow-up vendor updates.

Evidence notes

The debrief is based on the supplied NVD record for CVE-2023-2045, which shows a published date of 2023-05-24 and a last-modified date of 2024-11-21. The record identifies a vulnerable CPE for ipekyolunet:software_auto_damage_tracking_software with an upper version boundary of 4, and lists CWE-89 plus a third-party advisory reference from USOM. No KEV listing was provided in the supplied corpus.

Official resources

CVE published 2023-05-24. NVD last modified 2024-11-21. No known exploited vulnerability entry was supplied.