CVE-2023-48893

Name of the Vulnerable Software and Affected Versions SLiMS versions prior to 9.6.2

Description The issue allows for SQL injection, potentially enabling a remote attacker to obtain sensitive information and execute arbitrary code. This can be achieved by crafting a script to the date parameter in the staff act.php file, specifically via the startDate or untilDate parameters.

Recommendations For versions prior to 9.6.2, update to a version that contains a fix for this issue to prevent SQL injection attacks. As a temporary workaround, consider restricting access to the staff act.php file or limiting the input for the startDate and untilDate parameters until a patch is available.