CVE-2023-43983 in Presto Changeo attributegrid
Summary
by MITRE • 10/25/2023
Presto Changeo attributegrid up to 2.0.3 was discovered to contain a SQL injection vulnerability via the component disable_json.php.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 02/08/2026
The vulnerability identified as CVE-2023-43983 affects Presto Changeo attributegrid versions up to 2.0.3 and represents a critical SQL injection flaw that could enable unauthorized access to underlying database systems. This vulnerability specifically resides within the disable_json.php component of the software, making it a targeted attack vector for malicious actors seeking to exploit database interfaces. The flaw allows attackers to manipulate SQL queries through improper input validation, potentially leading to complete database compromise and unauthorized data access.
The technical implementation of this vulnerability stems from inadequate sanitization of user-supplied input parameters within the disable_json.php script. When the application processes requests through this component, it fails to properly escape or validate data before incorporating it into SQL query structures. This design flaw aligns with CWE-89 which specifically addresses SQL injection vulnerabilities where untrusted data is directly concatenated into SQL commands without proper encoding or parameterization. The vulnerability exists at the application layer where user input flows directly into database execution contexts, creating a pathway for attackers to inject malicious SQL payloads that can execute with the privileges of the database user.
The operational impact of this vulnerability extends beyond simple data theft to encompass complete system compromise and potential lateral movement within affected networks. Attackers could leverage this vulnerability to extract sensitive information including user credentials, personal data, and business-critical records stored within the database. The exploitation of this flaw could also enable attackers to modify or delete database content, potentially causing system downtime and data integrity issues. Furthermore, successful exploitation could provide attackers with a persistent foothold within the network, allowing for extended access and potential privilege escalation attacks that align with ATT&CK technique T1078.1.1 for valid accounts and T1046 for network service scanning to identify additional vulnerable systems.
Mitigation strategies for CVE-2023-43983 should prioritize immediate patching of affected Presto Changeo attributegrid installations to version 2.0.4 or later, which contains the necessary fixes for the SQL injection vulnerability. Organizations should implement proper input validation and parameterized queries throughout the application codebase to prevent similar issues in other components. Database access controls should be reviewed and restricted to minimize the impact of potential exploitation, ensuring that database users have the minimum necessary privileges. Network segmentation and intrusion detection systems should be deployed to monitor for suspicious database access patterns and SQL injection attempts. Additionally, regular security assessments and code reviews should be conducted to identify and remediate similar vulnerabilities in other applications and components within the organization's infrastructure.