CVE-2023-53960
Published: 22 December 2025
Description
SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the 'index.php' authentication mechanism that allows attackers to manipulate login credentials. Attackers can inject malicious SQL code through the 'password' POST parameter to bypass authentication and potentially gain unauthorized access…
more
to the system.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection attacks by requiring validation of untrusted inputs like the password POST parameter in the authentication mechanism.
Mandates timely remediation of the identified SQL injection flaw in index.php to eliminate the vulnerability.
Enables boundary protections such as web application firewalls to filter and block malicious SQL payloads targeting the login interface.
Security SummaryAI
CVE-2023-53960 is an SQL injection vulnerability (CWE-89) in the authentication mechanism of SOUND4 IMPACT, FIRST, PULSE, and Eco versions 2.x. The issue affects the 'index.php' file, where attackers can inject malicious SQL code via the 'password' POST parameter to manipulate login credentials. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with high impacts on confidentiality, integrity, and availability.
Remote attackers with no privileges or user interaction can exploit this vulnerability over the network with low complexity. By submitting crafted SQL payloads in the password field during login attempts, they can bypass authentication and gain unauthorized access to the system.
Advisories from VulnCheck and Zero Science Lab (ZSL-2022-5726) describe the SQL injection via authentication bypass, while a proof-of-concept exploit is publicly available on Exploit-DB (exploit 51171). No specific patch or mitigation details are provided in the referenced advisories.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web login (index.php) enables remote authentication bypass, directly facilitating T1190: Exploit Public-Facing Application.