CVEs-PoC/2023/CVE-2023-4538.md

CVE-2023-4538

Description

The database access credentials configured during installation are stored in a special table, and are encrypted with a shared key, same among all Comarch ERP XL client installations. This could allow an attacker with access to that table to retrieve plain text passwords.This issue affects ERP XL: from 2020.2.2 through 2023.2.

POC

Reference

No PoCs from references.

Github

• https://github.com/defragmentator/mitmsqlproxy