CVE-2023-3047

9.8 CRITICAL

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMT Lockcell allows SQL Injection.T...

Published: 2023-06-13 · Last updated: 2024-11-21

Severity and scoring

CVSS: 9.8 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-89

Affected products

Vendor	Product
tmtmakine	lockcell_firmware

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMT Lockcell allows SQL Injection.This issue affects Lockcell: before 15.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2023-3047
[Exploit reference]https://fordefence.com/cve-2023-3047-tmt-lockcell-sql-injection/
[Other]https://www.usom.gov.tr/bildirim/tr-23-0345
[Exploit reference]https://fordefence.com/cve-2023-3047-tmt-lockcell-sql-injection/
[Other]https://www.usom.gov.tr/bildirim/tr-23-0345

Related CVEs

Same vendor

CVE-2023-3050 — Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse... (9.8 CRITICAL)
CVE-2023-3049 — Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection.This issue affects Lockcell: befor... (9.8 CRITICAL)
CVE-2023-3048 — Authorization Bypass Through User-Controlled Key vulnerability in TMT Lockcell allows Authentication Abuse, Authentication Bypass.This is... (9.8 CRITICAL)

Same CWE

CVE-2026-53474 — A flaw was found in migration-planner (9.6 CRITICAL)
CVE-2026-52758 — Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL qu... (8.8 HIGH)
CVE-2026-49498 — Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to e... (8.8 HIGH)
CVE-2026-3018 — The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up t... (7.5 HIGH)
CVE-2026-3326 — The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX ... (8.6 HIGH)