CVE-2023-26443 (published 2023-08-02T12:23:17.319Z)
Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerability. We now properly encode single quotes for SQL FULLTEXT queries. No publicly available exploits are known.


Affected products: Vendor: OX Software GmbH
Product: OX App Suite
Versions: 0, 0