CVE-2023-34362

9.8

CRITICAL CVSS 3.1

Progress MOVEit Transfer SQL Injection Vulnerability - [Actively Exploited]

Description

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.

INFO

Published Date :

June 2, 2023, 2:15 p.m.

Last Modified :

Dec. 20, 2024, 5:49 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Jun 23, 2023

Alert Date: Jun 02, 2023 | 837 days ago

Description :

Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.

Required Action :

Apply updates per vendor instructions.

Notes :

This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023.; https://nvd.nist.gov/vuln/detail/CVE-2023-34362

Affected Products

The following products are affected by CVE-2023-34362 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Progress	moveit_transfer
2	Progress	moveit_cloud

: Total Affected Vendor : 1 | Products : 2

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				[email protected]
	CVSS 3.1	CRITICAL				134c704f-9b21-4f2e-91b3-4a467353bcc0

Solution

This information is provided by the 3rd party feeds.

Upgrade to Progress MOVEit Transfer version 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, 2023.0.1, or later or apply the special patch for version 2020.1.x.

Public PoC/Exploit Available at Github

CVE-2023-34362 has a 46 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2023-34362.

URL	Resource
http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html	Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html	Exploit Third Party Advisory VDB Entry
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023	Vendor Advisory
http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html	Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html	Exploit Third Party Advisory VDB Entry
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023	Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2023-34362 is associated with the following CWEs:

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2023-34362 weaknesses.

CAPEC-7: Blind SQL Injection Blind SQL Injection CAPEC-66: SQL Injection SQL Injection CAPEC-108: Command Line Execution through SQL Injection Command Line Execution through SQL Injection CAPEC-109: Object Relational Mapping Injection Object Relational Mapping Injection CAPEC-110: SQL Injection through SOAP Parameter Tampering SQL Injection through SOAP Parameter Tampering CAPEC-470: Expanding Control over the Operating System from the Database Expanding Control over the Operating System from the Database

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

orskoven/Software-Security-by-Socurity

None

Updated: 4 days, 1 hour ago

0 stars 0 fork 0 watcher

Born at : Sept. 9, 2025, 2:43 p.m. This repo has been linked 1 different CVEs too.

0xAj-Krishna/biggest-hack

None

Updated: 4 days, 6 hours ago

0 stars 0 fork 0 watcher

Born at : Sept. 9, 2025, 6:09 a.m. This repo has been linked 24 different CVEs too.

zhanpengliu-tencent/medium-cve

None

Updated: 1 month ago

0 stars 0 fork 0 watcher

Born at : Aug. 15, 2025, 9:07 a.m. This repo has been linked 310 different CVEs too.

joydada29/cybersecurity-watch-report

None

Updated: 1 month, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : July 31, 2025, 7:22 p.m. This repo has been linked 2 different CVEs too.

ravibalanraju/vulnerability-reports-case-studies

None

Updated: 1 month, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : July 28, 2025, 12:43 p.m. This repo has been linked 2 different CVEs too.

Naveenbana5250/CVE-2023-34362-Defense-Package

Threat-Informed Detection & Mitigation Package for MOVEit Transfer Vulnerability

Updated: 1 month, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : July 28, 2025, 5:55 a.m. This repo has been linked 1 different CVEs too.

cyberleelawat/LeelawatX-CVE-Hunter

Recon-focused toolkit (subdomain, CVE hunting)

Python

Updated: 1 month, 4 weeks ago

0 stars 0 fork 0 watcher

Born at : July 18, 2025, 7:47 a.m. This repo has been linked 10 different CVEs too.

Ishwor007/CyberSec-GPT

None

Python

Updated: 2 months, 1 week ago

0 stars 0 fork 0 watcher

Born at : July 5, 2025, 11:18 p.m. This repo has been linked 1 different CVEs too.

aqsakhan/osintiq

OSINTIQ: AI-Powered SOC Intelligence Hub Open-source threat intelligence enriched by AI, built for SOC analysts.

Python C JavaScript CSS PowerShell Batchfile HTML Procfile

Updated: 2 months, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : June 18, 2025, 8:53 p.m. This repo has been linked 1 different CVEs too.

xishir/cve-mcp-server

A Model Context Protocol server providing CVE vulnerability information query capabilities. This server enables LLMs to query detailed information for specific CVE IDs, retrieving data from MITRE's CVE database.

Python

Updated: 2 months, 2 weeks ago

1 stars 1 fork 1 watcher

Born at : May 9, 2025, 6:54 a.m. This repo has been linked 2 different CVEs too.

scoutbluehook/scoutbluehook

Config files for my GitHub profile.

config github-config

Updated: 7 months, 1 week ago

0 stars 0 fork 0 watcher

Born at : Feb. 8, 2025, 1:13 p.m. This repo has been linked 1 different CVEs too.

MaarsVillage/LogParser

Repository for LogParser scripts and other goodies

Updated: 7 months, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : Feb. 1, 2025, 4:32 p.m. This repo has been linked 2 different CVEs too.

bobmaars/LogParser

Repository for LogParser scripts and other goodies

Updated: 7 months, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : Feb. 1, 2025, 4:17 p.m. This repo has been linked 2 different CVEs too.

EberArenas/MOVEit-Data-Breach-Writeup

Writeup for MOVEit data breach

Updated: 7 months, 2 weeks ago

0 stars 0 fork 0 watcher

Born at : Jan. 22, 2025, 7:30 p.m. This repo has been linked 1 different CVEs too.

aditibv/MOVEit-CVE-2023-34362

This repository investigates the exploitation of CVE-2023-34362 in the MOVEit file transfer server by the TA505 (Cl0p) ransomware group. It explores the group's tactics and past campaigns targeting file transfer applications, aiming to enhance understanding and defensive measures against such threats.

Updated: 1 year, 1 month ago

0 stars 0 fork 0 watcher

Born at : July 4, 2024, 9:13 p.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2023-34362 vulnerability anywhere in the article.

Huntress

Ten Years of Resilience, Innovation & Community-Driven Defense

The world of cybersecurity has been a wild ride over the last decade. As attackers stepped up their game year over year, the security community responded and adapted with resilience and ingenuity to e ...

Published Date: Aug 25, 2025 (3 weeks, 1 day ago)

The Register

Cl0p cybercrime gang's data exfiltration tool found vulnerable to RCE attacks

Security experts have uncovered a hole in Cl0p's data exfiltration tool that could potentially leave the cybercrime group vulnerable to attack. The vulnerability in the Python-based software, which wa ...

Published Date: Jul 02, 2025 (2 months, 2 weeks ago)

The Hacker News

MOVEit Transfer Faces Increased Threats as Scanning Surges and CVE Flaws Are Targeted

Network Security / Vulnerability Threat intelligence firm GreyNoise is warning of a "notable surge" in scanning activity targeting Progress MOVEit Transfer systems starting May 27, 2025—suggesting tha ...

Published Date: Jun 27, 2025 (2 months, 2 weeks ago)

Cyber Security News

Surge in Attacks Targeting MOVEit Transfer Systems – 100+ Unique IPs Used by Attackers

Researchers observed a significant increase in malicious scanning activity targeting MOVEit Transfer systems observed with over 682 unique IP addresses participating in coordinated reconnaissance and ...

Published Date: Jun 26, 2025 (2 months, 3 weeks ago)

Help Net Security

CrushFTP: Patch critical vulnerability ASAP! (CVE-2025-2825)

CrushFTP has fixed a critical vulnerability (CVE-2025-2825) in its enterprise file transfer solution that could be exploited by remote, unauthenticated attackers to access vulnerable internet-facing s ...

Published Date: Mar 27, 2025 (5 months, 2 weeks ago)

Hackread - Latest Cybersecurity, Tech, Crypto & Hacking News

Cl0p Ransomware Exploits Cleo Vulnerability, Threatens Data Leaks

SUMMARY Cleo Vulnerability Exploited: The Cl0p ransomware group claims to have exploited a critical vulnerability in Cleo’s managed file transfer software, targeting businesses globally. Data Leak Thr ...

Published Date: Dec 16, 2024 (8 months, 4 weeks ago)

TheCyberThrone

Top 15 Most Exploited Vulnerabilities in 2023

In a joint cybersecurity advisory, the security agencies across the world have identified the most exploited vulnerabilities of 2023. This advisory, coauthored by the Cybersecurity and Infrastructure ...

Published Date: Nov 16, 2024 (10 months ago)

SentinelOne

The State of Cloud Ransomware in 2024

Overview Ransom attacks in the cloud are a perennially popular topic of discussion in the cloud security realm. Cloud services inherently provide an advantage over endpoint and web server-based servic ...

Published Date: Nov 14, 2024 (10 months ago)

SentinelOne

The State of Cloud Ransomware in 2024

Published Date: Nov 14, 2024 (10 months ago)

SentinelOne

The State of Cloud Ransomware in 2024

Published Date: Nov 14, 2024 (10 months ago)

The Register

Five Eyes infosec agencies list 2024's most exploited software flaws

The cyber security agencies of the UK, US, Canada, Australia, and New Zealand have issued their annual list of the 15 most exploited vulnerabilities, and warned that attacks on zero-day exploits have ...

Published Date: Nov 14, 2024 (10 months ago)

Cybersecurity News

2023’s Most Exploited Vulnerabilities: A Global Cybersecurity Advisory

In a joint cybersecurity advisory, the top cybersecurity agencies from the United States, Australia, Canada, New Zealand, and the United Kingdom have identified the most exploited vulnerabilities of 2 ...

Published Date: Nov 14, 2024 (10 months ago)

AttackIQ

Response to CISA Advisory (AA24-317A): 2023 Top Routinely Exploited Vulnerabilities

On November 12, 2024, the U.S. Cybersecurity & Infrastructure Security Agency (CISA) released a Cybersecurity Advisory (CSA) providing details on the Common Vulnerabilities and Exposures (CVEs) routin ...

Published Date: Nov 13, 2024 (10 months ago)

The Cyber Express

Top 15 Exploited Cyber Vulnerabilities Revealed: Five Eyes Alliance Urges Immediate Patching

The FBI, NSA, and allied agencies within the Five Eyes intelligence network have published a list of the 15 most exploited vulnerabilities from 2023. The cybersecurity advisory, a collaborative effort ...

Published Date: Nov 13, 2024 (10 months ago)

Dark Reading

Amazon Employee Data Compromised in MOVEit Breach

Source: Ian Dagnall via Alamy Stock PhotoAmazon has confirmed that its employees' data was exposed on a cybercrime forum due to the now-infamous MOVEit vulnerability.The vulnerability, tracked as CVE- ...