External risk intelligence

Bloofox CMS SQL Injection in Settings.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-34752

The vulnerability affects a CMS, which is a web-based application designed to be internet-facing to serve content. As a web application, it is commonly deployed on public-facing servers, making the administration interface where this vulnerability resides a common target for external reachability in standard deployments.

SQL Injection

Bloofoxcms

0.5.2.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical SQL injection vulnerability in bloofoxcms, a web content management system. The flaw allows unauthenticated attackers to directly manipulate the system's database by exploiting a vulnerable parameter. At a high level, this could lead to unauthorized access, data corruption, or complete system compromise if the affected component is exposed externally.

Affects database integrity in web content systems.
Critical flaw allows unauthenticated database access.
Confirm relevance and understand potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could potentially exploit this vulnerability by sending a specially crafted request to the `admin/index.php` file, targeting the `lid` parameter within the settings for language edits. This could allow an unauthenticated attacker to execute arbitrary SQL commands on the server, potentially leading to unauthorized access, data modification, or even complete system compromise.

No authentication required.
SQL injection via `lid` parameter.
Data compromise and system control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the server. When supported by the advisory, this could impact the integrity and confidentiality of the application's database, potentially exposing sensitive information or disrupting service operations.

Database integrity and confidentiality at risk.
Via unauthenticated SQL injection in admin settings.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The presence of a SQL injection vulnerability in bloofoxcms suggests that application owners and platform teams are primarily responsible for addressing this issue. The initial focus should be on identifying all instances of bloofoxcms within the environment, confirming their exposure and criticality, and then determining the appropriate remediation or mitigation strategy.

Identify application and platform owners.
Verify bloofoxcms deployment and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is bloofoxcms?

bloofoxcms is a lightweight, PHP-based content management system used to build and manage websites. It provides an administrative interface for site configuration, such as managing language settings, which is where this specific vulnerability resides.

How does CVE-2023-34752 work?

This vulnerability is a SQL injection, which falls under the CWE-89 weakness class. It occurs when an application fails to properly sanitize user-provided input. In this case, the 'lid' parameter in the administrative settings allows an attacker to inject malicious SQL commands, which the database then executes, potentially bypassing security controls.

Do I need to be logged in to trigger this bug?

No, authentication is not required to exploit this flaw. An attacker can send a crafted request directly to the vulnerable 'admin/index.php' page. The vulnerability is triggered specifically through the 'lid' parameter; standard navigation or interactions that do not involve this specific parameter will not invoke the malicious SQL injection path.

Is this vulnerability a risk for my servers?

If you run bloofoxcms, this is a significant risk. Halo Surface Signal notes that because this is a web-based CMS, these applications are typically deployed in internet-facing environments to serve content. An administrative interface exposed to the public internet creates a direct path for external actors to reach and exploit this vulnerability without needing prior system access.

When should I take action on this CVE?

You should prioritize this immediately if you have bloofoxcms installed. First, inventory your environment to locate all instances of the application. Confirm which instances are accessible via the network, evaluate their role, and work with your platform teams to apply the necessary remediation or mitigation steps to secure your database integrity.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.