CVE-2023-28824

Server-side request forgery vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected product with an administrative privilege may bypass the database restriction set on the query setting page, and connect to a user unintended database.

• CWE-918
• CWE-918

• https://jvn.jp/en/vu/JVNVU93372935/Third Party Advisory
• https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_en.pdfVendor Advisory
• https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_jp.pdfVendor Advisory
• https://jvn.jp/en/vu/JVNVU93372935/Third Party Advisory
• https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_en.pdfVendor Advisory
• https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_jp.pdfVendor Advisory

Published

Jun 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28818An issue was discovered in Veritas NetBackup IT Analytics 11…5.3
• CVE-2023-28819Concrete CMS (previously concrete5) versions 8.5.12 and belo…5.4
• CVE-2023-2882Generation of Incorrect Security Tokens vulnerability in CBO…9.8
• CVE-2023-28820Concrete CMS (previously concrete5) before 9.1 is vulnerable…5.4
• CVE-2023-28821Concrete CMS (previously concrete5) before 9.1 did not have …5.3
• CVE-2023-28823Uncontrolled search path in some Intel(R) oneAPI Toolkit and…7.3
• CVE-2023-28826This issue was addressed with improved redaction of sensitiv…5.5
• CVE-2023-28827A vulnerability has been identified in SIMATIC CP 1242-7 V2 …8.2
• CVE-2023-28828A vulnerability has been identified in Polarion ALM (All ver…5.9
• CVE-2023-28829A vulnerability has been identified in SIMATIC NET PC Softwa…8.8
• CVE-2023-2883Authorization Bypass Through User-Controlled Key vulnerabili…8.8
• CVE-2023-28830A vulnerability has been identified in JT2Go (All versions <…7.8