CVE-2023-33993: SQL Injection vulnerability in SAP Business One B1i Layer

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-08 · updated 2026-06-17
Weakness: CWE-89

Description

B1i module of SAP Business One - version 10.0, application allows an authenticated user with deep knowledge to send crafted queries over the network to read or modify the SQL data. On successful exploitation, the attacker can cause high impact on confidentiality, integrity and availability of the application.

Affected products

SAP SE SAP Business One: 10.0

References

https://me.sap.com/notes/3337797
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
https://me.sap.com/notes/3337797
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Get alerted when CVE-2023-33993 or the next vulnerability affects your stack