CVE-2023-3478

A vulnerability classified as critical was found in IBOS OA 4.5.5. Affected by this vulnerability is the function actionEdit of the file ?r=dashboard/roleadmin/edit&op=member of the component Add User Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-232759. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-89
• CWE-89

• https://github.com/ShuangbiaoDai/CVE/blob/main/ibos%20oa.mdExploit
• https://vuldb.com/?ctiid.232759VDB Entry
• https://vuldb.com/?id.232759Permissions Required, VDB Entry
• https://github.com/ShuangbiaoDai/CVE/blob/main/ibos%20oa.mdExploit
• https://vuldb.com/?ctiid.232759VDB Entry
• https://vuldb.com/?id.232759Permissions Required, VDB Entry

Published

Jun 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34755bloofox v0.5.2.1 was discovered to contain a SQL injection v…9.8
• CVE-2023-34756bloofox v0.5.2.1 was discovered to contain a SQL injection v…9.8
• CVE-2023-34758Sliver from v1.5.x to v1.5.39 has an improper cryptographic …8.1
• CVE-2023-3476A vulnerability was found in SimplePHPscripts GuestBook Scri…6.1
• CVE-2023-34761An unauthenticated attacker within BLE proximity can remotel…6.5
• CVE-2023-3477A vulnerability was found in RocketSoft Rocket LMS 1.7. It h…6.1
• CVE-2023-3479Cross-site Scripting (XSS) - Reflected in GitHub repository …6.1
• CVE-2023-34795xlsxio v0.1.2 to v0.2.34 was discovered to contain a free of…7.8
• CVE-2023-34796Cross site scripting (XSS) vulnerabiliy in dmarcts-report-vi…6.1
• CVE-2023-34797Broken access control in the Registration page (/Registratio…5.4
• CVE-2023-34798An arbitrary file upload vulnerability in eoffice before v9.…9.8
• CVE-2023-34800D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a …9.8