CVE-2023-54163

NLB mKlik Macedonia 3.3.12 contains a SQL injection vulnerability in international transfer parameters that allows attackers to manipulate database queries. Attackers can inject arbitrary SQL code through unsanitized input to potentially disclose sensitive information from the mobile banking application.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cxsecurity.com/issue/WLB-2023100040	Issue Tracking Third Party Advisory
https://packetstormsecurity.com/files/175113/NLB-mKlik-Makedonija-3.3.12-SQL-Injection.html	Third Party Advisory
https://play.google.com/store/apps/details?id=hr.asseco.android.jimba.tutunskamk.production	Product
https://www.vulncheck.com/advisories/nlb-mklik-macedonia-sql-injection-via-international-transfer-parameters	Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5797.php	Third Party Advisory
https://cxsecurity.com/issue/WLB-2023100040	Issue Tracking Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5797.php	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nlb:mklik_makedonija:3.3.12:*:*:*:*:android:*:*

History

24 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) NLB mKlik Macedonia 3.3.12 contiene una vulnerabilidad de inyección SQL en los parámetros de transferencia internacional que permite a los atacantes manipular consultas de base de datos. Los atacantes pueden inyectar código SQL arbitrario a través de entradas no saneadas para potencialmente divulgar información sensible de la aplicación de banca móvil.

Information

Published : 2025-12-30 23:15

Updated : 2026-09-24 23:10

NVD link : CVE-2023-54163

Mitre link : CVE-2023-54163

CVE.ORG link : CVE-2023-54163

JSON object : View

Products Affected

nlb

mklik_makedonija

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2023-54163", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-54163", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-02T14:25:19.133279Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "NLB Banka AD Skopje", "product": "NLB mKlik Makedonija", "versions": [{"status": "affected", "version": "3.3.12"}]}]}], "published": "2025-12-30T23:15:48.337", "references": [{"url": "https://cxsecurity.com/issue/WLB-2023100040", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://packetstormsecurity.com/files/175113/NLB-mKlik-Makedonija-3.3.12-SQL-Injection.html", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://play.google.com/store/apps/details?id=hr.asseco.android.jimba.tutunskamk.production", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/nlb-mklik-macedonia-sql-injection-via-international-transfer-parameters", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5797.php", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://cxsecurity.com/issue/WLB-2023100040", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5797.php", "tags": ["Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "NLB mKlik Macedonia 3.3.12 contains a SQL injection vulnerability in international transfer parameters that allows attackers to manipulate database queries. Attackers can inject arbitrary SQL code through unsanitized input to potentially disclose sensitive information from the mobile banking application."}, {"lang": "es", "value": "NLB mKlik Macedonia 3.3.12 contiene una vulnerabilidad de inyecci\u00f3n SQL en los par\u00e1metros de transferencia internacional que permite a los atacantes manipular consultas de base de datos. Los atacantes pueden inyectar c\u00f3digo SQL arbitrario a trav\u00e9s de entradas no saneadas para potencialmente divulgar informaci\u00f3n sensible de la aplicaci\u00f3n de banca m\u00f3vil."}], "lastModified": "2026-09-24T23:10:00.133", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nlb:mklik_makedonija:3.3.12:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "B9A230B7-BB90-4D31-9010-D5C8B24414EB"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}