CVE-2023-39423 — Improper Neutralization of Special Elements used in an SQL Command in RDPData.dll
The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions t…
Published: 2023-09-07 · CVSS: 8.6 · CVSS 3.1
The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7