CVE-2023-2963
📋 TL;DR
This SQL injection vulnerability in Oliva Expertise EKS allows attackers to execute arbitrary SQL commands on the database. It affects all Oliva Expertise EKS installations before version 1.2, potentially compromising sensitive data and system integrity.
💻 Affected Systems
- Oliva Expertise EKS
📦 What is this software?
Oliva Ekspertiz by Olivaekspertiz
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, authentication bypass, and potential remote code execution on the database server.
Likely Case
Unauthorized data access, extraction of sensitive information, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permissions in place.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited with automated tools. The specific exploit details are not publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2
Vendor Advisory: https://www.usom.gov.tr/bildirim/tr-23-0409
Restart Required: Yes
Instructions:
1. Download Oliva Expertise EKS version 1.2 or later from official sources. 2. Backup current installation and database. 3. Stop the application service. 4. Install the updated version. 5. Restart the application service. 6. Verify functionality.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious requests.
Input Validation Filter
allImplement application-level input validation to reject SQL special characters in user inputs.
🧯 If You Can't Patch
- Isolate the affected system from internet access and restrict to necessary internal networks only.
- Implement strict database permissions, using least privilege principles for application database accounts.
🔍 How to Verify
Check if Vulnerable:
Check the application version in administration interface or configuration files. If version is below 1.2, the system is vulnerable.Check Version:
Check application configuration or administration panel for version information.Verify Fix Applied:
Confirm the application version is 1.2 or higher after patching and test SQL injection attempts are properly blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual database queries in application logs
- SQL syntax errors in logs
- Multiple failed login attempts with SQL-like patterns
Network Indicators:
- HTTP requests containing SQL keywords (SELECT, UNION, INSERT, etc.)
- Unusual database connection patterns
SIEM Query:
source="application_logs" AND ("SQL syntax" OR "SELECT *" OR "UNION SELECT")