Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-34362
Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
MoveIT SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MoveIT是MoveIT公司的一款针对机械臂移动操作的最先进的软件。 MoveIT 存在安全漏洞,该漏洞源于存在SQL注入漏洞。攻击者可利用该漏洞访问数据库并执行更改或删除操作。受影响的产品和版本: Progress MOVEit Transfer 2021.0.6 (13.0.6)之前版本,2021.1.4 (13.1.4)版本, 2022.0.4 (14.0.4)版本, 2022.1.5 (14.1.5)版本, 2023.0.1 (15.0.1)版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
VendorProductAffected VersionsCPESubscribe
-n/a n/a -
II. Public POCs for CVE-2023-34362
#POC DescriptionSource LinkShenlong Link
1CVE-2023-34362-IOCs. More information on Deep Instinct's blog site.https://github.com/deepinstinct/MOVEit_CVE-2023-34362_IOCsPOC Details
2MOVEit CVE-2023-34362https://github.com/horizon3ai/CVE-2023-34362POC Details
3CVE-2023-34362: MOVEit Transfer Unauthenticated RCEhttps://github.com/sfewer-r7/CVE-2023-34362POC Details
4Repository with everything I have tracking the impact of MOVEit CVE-2023-34362https://github.com/kenbuckler/MOVEit-CVE-2023-34362POC Details
5POC for CVE-2023-34362 affecting MOVEit Transferhttps://github.com/Malwareman007/CVE-2023-34362POC Details
6This shellscript given the OrgKey 0 will parse the header of the base64 artifacts found in MOVEit Logs and decrypt the Serialized object used a payloadhttps://github.com/toorandom/moveit-payload-decrypt-CVE-2023-34362POC Details
7an exploit of POC for CVE-2023-34362 affecting MOVEit Transferhttps://github.com/errorfiathck/MOVEit-ExploitPOC Details
8A video presentation analysing the technical details, scale and lessons to be learned from the MOVEit CVE-2023=3462(CS50 Introduction to Cyber Security Finale Project)https://github.com/Chinyemba-ck/MOVEit-CVE-2023-34362POC Details
9Modified RCE with a remote shell and logginghttps://github.com/glen-pearson/MoveIT-CVE-2023-34362-RCEPOC Details
10Nonehttps://github.com/aditibv/MOVEit-CVE-2023-34362POC Details
11In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34362.yamlPOC Details
12Threat-Informed Detection & Mitigation Package for MOVEit Transfer Vulnerabilityhttps://github.com/Naveenbana5250/CVE-2023-34362-Defense-PackagePOC Details
13MOVEit Transfer 2023 mass data breach (CVE-2023-34362)https://github.com/khengar9274-web/moveit-transfer-2023-breachPOC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC
III. Intelligence Information for CVE-2023-34362
Please Login to view more intelligence information
IV. Related Vulnerabilities
V. Comments for CVE-2023-34362

No comments yet


Leave a comment