{"metadata": {"vulnerability": "cve-2023-28424", "count": 19, "kinds": {"milestone": 3, "sighting": 4, "kev": 0, "other": 12}}, "data": [{"timestamp": "2023-03-15T15:59:10.046Z", "date_only": false, "value": "2023-03-15T15:59:10.046Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2023-28424", "field": "cveMetadata.dateReserved"}, {"timestamp": "2023-03-20T00:00:00Z", "date_only": true, "value": "2023-03-20", "kind": "other", "label": "Pubdate", "source": "gsd \u00b7 GSD-2023-28424", "record": "GSD-2023-28424", "field": "namespaces.gitlab.com.advisories.0.pubdate", "linked_record": true}, {"timestamp": "2023-03-20T12:47:13.250Z", "date_only": false, "value": "2023-03-20T12:47:13.250Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2023-28424", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2023-03-20T13:15:00Z", "date_only": false, "value": "2023-03-20T13:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2023-28424", "record": "GSD-2023-28424", "field": "namespaces.nvd.nist.gov.publishedDate", "linked_record": true}, {"timestamp": "2023-03-20T13:15:11.973Z", "date_only": false, "value": "2023-03-20T13:15:11.973", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2023-28424", "record": "FKIE_CVE-2023-28424", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2023-03-20T16:54:01Z", "date_only": false, "value": "2023-03-20T16:54:01.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/60309", "record": "CVE-2023-28424", "field": "creation_timestamp", "uuid": "ecf3bcd2-227e-4190-b1d6-d2bb7c1db177", "content": "\u203c CVE-2023-28424 \u203c\n\nSoko if the code that powers packages.gentoo.org. Prior to version 1.0.2, the two package search handlers, `Search` and `SearchFeed`, implemented in `pkg/app/handler/packages/search.go`, are affected by a SQL injection via the `q` parameter. As a result, unauthenticated attackers can execute arbitrary SQL queries on `https://packages.gentoo.org/`. It was also demonstrated that primitive was enough to gain code execution in the context of the PostgreSQL container. The issue was addressed in commit `4fa6e4b619c0362728955b6ec56eab0e0cbf1e23y` of version 1.0.2 using prepared statements to interpolate user-controlled data in SQL queries.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/60309"}, {"timestamp": "2023-03-24T00:00:00Z", "date_only": true, "value": "2023-03-24", "kind": "other", "label": "Date", "source": "gsd \u00b7 GSD-2023-28424", "record": "GSD-2023-28424", "field": "namespaces.gitlab.com.advisories.0.date", "linked_record": true}, {"timestamp": "2023-03-24T18:34:00Z", "date_only": false, "value": "2023-03-24T18:34Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2023-28424", "record": "GSD-2023-28424", "field": "namespaces.nvd.nist.gov.lastModifiedDate", "linked_record": true}, {"timestamp": "2023-06-28T15:51:20Z", "date_only": false, "value": "2023-06-28T15:51:20.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/YPSFRJaXJu22SzL-lnmgNittGl2SN26SC5hMmH64EzvAW7E", "record": "CVE-2023-28424", "field": "creation_timestamp", "uuid": "aa05f64b-9e32-420b-bf7a-fadeffb88ec1"}, {"timestamp": "2023-07-08T12:47:01Z", "date_only": false, "value": "2023-07-08T12:47:01.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityTechnologies/8632", "record": "CVE-2023-28424", "field": "creation_timestamp", "uuid": "7e50a019-70b3-4ec8-85ca-2d47c998dfee", "content": "#Threat_Research\nSQL Injections in Soko:\nWhy ORMs and Prepared Statements Can't (Always) Win (CVE-2023-28424)\nhttps://www.sonarsource.com/blog/why-orms-and-prepared-statements-cant-always-win", "url": "https://t.me/CyberSecurityTechnologies/8632"}, {"timestamp": "2023-07-11T13:41:26Z", "date_only": false, "value": "2023-07-11T13:41:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/4725", "record": "CVE-2023-28424", "field": "creation_timestamp", "uuid": "5377bca8-e197-4c79-ac1a-4a02c7c92a90", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2023\n\u63cf\u8ff0\uff1aCVE-2023-28424\nURL\uff1ahttps://github.com/Fire-Null/CVE-2023-28424\n\n\u6807\u7b7e\uff1a#CVE-2023", "url": "https://t.me/GithubRedTeam/4725", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2023-12-13T01:20:48.110Z", "date_only": false, "value": "2023-12-13T01:20:48.110005Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2023-28424", "record": "GSD-2023-28424", "field": "gsd.osvSchema.modified", "linked_record": true}, {"timestamp": "2024-08-02T12:38:25.448Z", "date_only": false, "value": "2024-08-02T12:38:25.448Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2023-28424", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-12-12T20:40:18.902Z", "date_only": false, "value": "2024-12-12T20:40:18.902Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2023-28424", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-25T14:30:22.571Z", "date_only": false, "value": "2025-02-25T14:30:22.571444Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2023-28424", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2025-02-25T14:30:22.571Z", "date_only": false, "value": "2025-02-25T14:30:22.571444Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2023-28424", "record": "FKIE_CVE-2023-28424", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-02-25T14:52:46.552Z", "date_only": false, "value": "2025-02-25T14:52:46.552Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2023-28424", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-02-25T14:52:46.552Z", "date_only": false, "value": "2025-02-25T14:52:46.552Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2023-28424", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-17T05:47:41.300Z", "date_only": false, "value": "2026-06-17T05:47:41.300", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2023-28424", "record": "FKIE_CVE-2023-28424", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-08T19:05:44.295Z", "anchors": {"origin": {"timestamp": "2023-03-20T12:47:13.250Z", "date_only": false, "value": "2023-03-20T12:47:13.250Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2023-28424", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2023-03-20T12:47:13.250Z", "date_only": false, "value": "2023-03-20T12:47:13.250Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2023-28424", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2023-07-11T13:41:26Z", "date_only": false, "value": "2023-07-11T13:41:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/4725", "record": "CVE-2023-28424", "field": "creation_timestamp", "uuid": "5377bca8-e197-4c79-ac1a-4a02c7c92a90", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2023\n\u63cf\u8ff0\uff1aCVE-2023-28424\nURL\uff1ahttps://github.com/Fire-Null/CVE-2023-28424\n\n\u6807\u7b7e\uff1a#CVE-2023", "url": "https://t.me/GithubRedTeam/4725", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 9766452.75, "hours": 2712.9035416666666, "days": 113.03764756944445, "min_seconds": 9766452.75, "max_seconds": 9766452.75, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2023-03-20T12:47:13.250Z", "date_only": false, "value": "2023-03-20T12:47:13.250Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2023-28424", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2023-07-11T13:41:26Z", "date_only": false, "value": "2023-07-11T13:41:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/4725", "record": "CVE-2023-28424", "field": "creation_timestamp", "uuid": "5377bca8-e197-4c79-ac1a-4a02c7c92a90", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2023\n\u63cf\u8ff0\uff1aCVE-2023-28424\nURL\uff1ahttps://github.com/Fire-Null/CVE-2023-28424\n\n\u6807\u7b7e\uff1a#CVE-2023", "url": "https://t.me/GithubRedTeam/4725", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 114848311.04504, "hours": 31902.308623622223, "days": 1329.2628593175925, "min_seconds": 114848311.04504, "max_seconds": 114848311.04504, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2023-03-20T12:47:13.250Z", "date_only": false, "value": "2023-03-20T12:47:13.250Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2023-28424", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T19:05:44.295Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 105081858.29504, "hours": 29189.405081955556, "days": 1216.225211748148, "min_seconds": 105081858.29504, "max_seconds": 105081858.29504, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2023-07-11T13:41:26Z", "date_only": false, "value": "2023-07-11T13:41:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/4725", "record": "CVE-2023-28424", "field": "creation_timestamp", "uuid": "5377bca8-e197-4c79-ac1a-4a02c7c92a90", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2023\n\u63cf\u8ff0\uff1aCVE-2023-28424\nURL\uff1ahttps://github.com/Fire-Null/CVE-2023-28424\n\n\u6807\u7b7e\uff1a#CVE-2023", "url": "https://t.me/GithubRedTeam/4725", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-08T19:05:44.295Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}