External risk intelligence

AM Presencia SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-27779

The vulnerability exists in the login form of a web application. Login portals are by design public-facing services intended to be accessed over the internet to facilitate user authentication, making them inherently reachable from the network edge in typical deployments.

SQL Injection

Amsystem Am Presencia

3.7.3

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical SQL injection vulnerability found in AM Presencia v3.7.3, affecting its user login functionality. Such vulnerabilities can allow unauthorized access to sensitive data or system compromise if exploited. The main concern is to confirm if this specific technology is in use and assess any potential exposure.

Unauthorized data access is possible.
Critical systems are often targeted by attackers.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could begin by accessing the application's login page over the network. By submitting specially crafted input in the "user" field, they can trigger a SQL injection vulnerability within the login form. If successful, this vulnerability could allow an attacker to gain unauthorized access to sensitive data or even alter system information.

Accessible via the network.
User parameter in login form.
Unauthorized data access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in AM Presencia could allow an unauthenticated attacker to inject malicious SQL code into the system through the login form's user parameter. This could potentially lead to unauthorized access to sensitive data or the disruption of normal service operations.

User data and system integrity.
Via specially crafted login requests.
Unauthorized data access or system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in AM Presencia likely impacts application owners responsible for the AM Presencia software and the infrastructure teams managing its deployment. The immediate first step is to identify all instances of AM Presencia, assess their reachability and business criticality, and then locate the specific accountable owner to plan remediation.

Identify the application owner.
Verify external reachability and criticality.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AM Presencia?

AM Presencia is a software application developed by amsystem, typically used by organizations to manage employee attendance and presence tracking. Version 3.7.3 is specifically identified as being affected by this security issue.

What is the nature of the CVE-2023-27779 vulnerability?

This vulnerability is classified as a SQL injection (CWE-89). It occurs when an application improperly handles user input, allowing an attacker to insert or 'inject' malicious database commands. In this case, the weakness exists within the login form, potentially granting unauthorized access to the underlying database.

How can an attacker trigger this SQL injection?

An attacker triggers this flaw by submitting specially crafted input into the user parameter field on the AM Presencia login page. This bug requires interacting with the login form; it is not triggered by normal, legitimate user activity or by simply navigating to the page without submitting malicious data.

Do I need to worry if my AM Presencia instance is internal?

Halo Surface Signal notes that login portals are designed to be reachable over the network to facilitate authentication. While an internal-only instance may have a smaller footprint than one exposed to the public internet, SQL injection risks remain significant because the vulnerability exists at the application layer, which can be reached by anyone with network access to the server.

When should I take action for this vulnerability?

You should act immediately by locating all instances of AM Presencia within your environment. Verify who owns the application and its business criticality. Once identified, work with the relevant teams to coordinate with the vendor for remediation steps to secure the login form.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.