CVE-2023-54163
📋 TL;DR
CVE-2023-54163 is a SQL injection vulnerability in NLB mKlik Macedonia mobile banking app version 3.3.12. Attackers can inject malicious SQL code through international transfer parameters to potentially access sensitive banking data. This affects users of the vulnerable mobile banking application in Macedonia.
💻 Affected Systems
- NLB mKlik Macedonia
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including customer financial data, transaction history, and authentication credentials leading to financial fraud and data breach.
Likely Case
Unauthorized access to sensitive customer information and potential manipulation of transaction data.
If Mitigated
Limited impact with proper input validation and database permissions restricting unauthorized access.
🎯 Exploit Status
Exploitation requires user interaction with the app and knowledge of SQL injection techniques. Public proof-of-concept details available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - check Google Play Store for latest version
Vendor Advisory: Not publicly available
Restart Required: Yes
Instructions:
1. Open Google Play Store
2. Search for NLB mKlik Macedonia
3. Check for available updates
4. Install latest version
5. Restart the application
🔧 Temporary Workarounds
Disable International Transfers
androidTemporarily disable international transfer functionality in the app settings
Application Whitelisting
allRestrict app usage to trusted networks only
🧯 If You Can't Patch
- Disable the mobile banking application until patch is available
- Implement network-level monitoring for unusual SQL-like patterns in application traffic
🔍 How to Verify
Check if Vulnerable:
Check app version in Google Play Store or app settings - if version is 3.3.12, it is vulnerableCheck Version:
Check app version in Android Settings > Apps > NLB mKlik MacedoniaVerify Fix Applied:
Update to latest version from Google Play Store and verify version number has changed from 3.3.12📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed international transfer attempts with malformed parameters
Network Indicators:
- SQL keywords in HTTP POST parameters to transfer endpoints
- Unusual database query patterns from mobile app
SIEM Query:
source="app_logs" AND (message="*SQL*" OR message="*syntax*" OR message="*injection*") AND app="nlb_mklik"🔗 References
- https://cxsecurity.com/issue/WLB-2023100040
- https://packetstormsecurity.com/files/175113/NLB-mKlik-Makedonija-3.3.12-SQL-Injection.html
- https://play.google.com/store/apps/details?id=hr.asseco.android.jimba.tutunskamk.production
- https://www.vulncheck.com/advisories/nlb-mklik-macedonia-sql-injection-via-international-transfer-parameters
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5797.php
- https://cxsecurity.com/issue/WLB-2023100040
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5797.php
