{"id":"CVE-2023-34362","published":"2023-06-02T14:15:09Z","modified":"2026-06-17T06:03:28Z","title":"Progress MOVEit Transfer SQL Injection Vulnerability","vendor":"Progress","product":"MOVEit Transfer","tier":"core","eol":null,"description":{"text":"In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.","provenance":"source","from":"NVD"},"summary":{"text":"A SQL injection flaw in Progress MOVEit Transfer's web application affects all versions prior to the patched releases (including 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5 and 2023.0.1, and older unsupported versions). An unauthenticated remote attacker can reach the database over HTTP or HTTPS with no user interaction, and can infer its structure and contents or run SQL statements that alter or delete data, depending on whether the backend is MySQL, Microsoft SQL Server or Azure SQL.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:16Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99934,"percentile":0.9997,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-06-02","dueDate":"2023-06-23","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023.;  https://nvd.nist.gov/vuln/detail/CVE-2023-34362","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-06-01","exploitedFirstSeen":"2023-06-01","ransomware":true,"evidence":[{"url":"https://cisa.gov/news-events/alerts/2023/06/01/progress-software-releases-security-advisory-moveit-transfer","date":"2023-06-01"},{"url":"https://twitter.com/cglyer/status/1665539162462736386","date":"2023-06-02"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-06-02"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-34362","date":"2023-06-02"},{"url":"https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft","date":"2023-06-02"},{"url":"https://fourcore.io/blogs/clop-ransomware-history-adversary-simulation","date":"2023-06-03"},{"url":"https://twitter.com/MsftSecIntel/status/1665537730946670595","date":"2023-06-05"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-158a","date":"2023-06-07"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","date":"2023-06-07"},{"url":"https://www.hhs.gov/sites/default/files/threat-profile-june-2023.pdf","date":"2023-06-13"}],"evidenceTotal":119,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34362","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: SQL Injection","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: SQL Injection","mappingType":"primary_impact","evidence":[],"comment":"CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts.","confidence":"high"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: SQL Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts.","confidence":"high"},{"id":"T1082","name":"System Information Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: SQL Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts.","confidence":"high"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: SQL Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts.","confidence":"high"},{"id":"T1136","name":"Create Account","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: SQL Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts.","confidence":"high"},{"id":"T1531","name":"Account Access Removal","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: SQL Injection","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-34362 is a SQL injection vulnerability in a public-facing application. Adversaries have been observed to exploit this vulnerability to install malicious software on a target system, enabling them to discover system settings and information, enumerate the underlying SQL database, retrieve files, create administrator accounts, and delete accounts.","confidence":"high"}],"reports":[{"id":"SRC-b804e28bf5894dd4955f","title":"Whitepaper Name Goes","publisher":"trustwave.com","url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/Trustwave_SpiderLabs_2023_Hospitality_Sector_Threat_Landscape.pdf","date":null,"mentions":[{"quote":"To put this into context, in Trustwave SpiderLabs data, the MOVEit RCE (CVE-\r\n2023-34362) vulnerability is one of the top exploits targeting hospitality","start":24729,"end":24881},{"quote":"(CVE-2023-34362) is one of the top exploits targeting our hospitality clients.","start":48980,"end":49058},{"quote":"▪ In addition to exploiting a previously undisclosed vulnerability (CVE-2023-\r\n34362) in MOVEit Transfer, group has a history of conducting similar","start":94158,"end":94305}]},{"id":"SRC-19738fcee43070f8d4e2","title":"Zero-Day Vulnerability in MOVEit Transfer Exploited for Data Theft","publisher":"mandiant.com","url":"https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft","date":null,"mentions":[{"quote":"This vulnerability was announced by Progress Software Corporation on May 31, 2023 and has been assigned CVE-2023-34362.","start":303,"end":422},{"quote":"the listed authors are dozens of consultants and analysts who have already been working to help our clients with cases related to exploitation of CVE-2023-34362.","start":13899,"end":14060}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-38442","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-38442","exploited":true,"exploitedSince":"2023-06-02","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":17,"skipped":0,"earliest":"2023-06-06","earliestUrl":"https://github.com/deepinstinct/MOVEit_CVE-2023-34362_IOCs","repos":[{"name":"horizon3ai/CVE-2023-34362","url":"https://github.com/horizon3ai/CVE-2023-34362","stars":140,"created":"2023-06-09"},{"name":"sfewer-r7/CVE-2023-34362","url":"https://github.com/sfewer-r7/CVE-2023-34362","stars":64,"created":"2023-06-12"},{"name":"Malwareman007/CVE-2023-34362","url":"https://github.com/Malwareman007/CVE-2023-34362","stars":10,"created":"2023-07-09"},{"name":"kenbuckler/MOVEit-CVE-2023-34362","url":"https://github.com/kenbuckler/MOVEit-CVE-2023-34362","stars":6,"created":"2023-06-16"},{"name":"deepinstinct/MOVEit_CVE-2023-34362_IOCs","url":"https://github.com/deepinstinct/MOVEit_CVE-2023-34362_IOCs","stars":2,"created":"2023-06-06"}]},"metasploit":[{"name":"MOVEit SQL Injection vulnerability","module":"exploit/windows/http/moveit_cve_2023_34362","type":"exploit","disclosureDate":"2023-05-31","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/moveit_cve_2023_34362.rb"}],"nuclei":[{"id":"CVE-2023-34362","name":"MOVEit Transfer - Remote Code Execution","severity":"critical","path":"http/cves/2023/CVE-2023-34362.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-34362.yaml"}],"first":{"date":"2023-05-31","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/moveit_cve_2023_34362.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request","id":"435e41f2-48eb-4c95-8a2b-ed24b50ec30b","level":"high","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/web_cve_2023_34362_known_payload_request.yml.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/web_cve_2023_34362_known_payload_request.yml.yml","techniques":["T1505.003"]},{"title":"Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity","id":"c3b2a774-3152-4989-83c1-7afc48fd1599","level":"high","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/file_event_win_exploit_cve_2023_34362_moveit_transfer.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/file_event_win_exploit_cve_2023_34362_moveit_transfer.yml","techniques":["T1190"]},{"title":"Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE","id":"39ac1fb0-07f1-474b-b97e-c5c0eace0d79","level":"medium","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/proc_creation_win_exploit_cve_2023_34362_moveit_transfer_exploitation_activity.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/proc_creation_win_exploit_cve_2023_34362_moveit_transfer_exploitation_activity.yml","techniques":["T1059"]}]},"exploitRefs":["http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html","http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1136","T1082","T1005","T1105","T1531"],"provenance":"source"}],"timeline":[{"date":"2023-05-31","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-06-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/moveit_cve_2023_34362.rb","provenance":"source"},{"date":"2023-06-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cisa.gov/news-events/alerts/2023/06/01/progress-software-releases-security-advisory-moveit-transfer","provenance":"source"},{"date":"2023-06-02","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34362","provenance":"source"},{"date":"2023-06-02","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-06-02","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-38442","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":0},"priority":{"score":86.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1246 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 NVD exploit link; 17 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}