Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-46954 | Kitploit
Tools/GitHubGitHub/jakedmurphy1/cve-2023-46954
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHubjakedmurphy1/cve-2023-46954

CVE-2023-46954

View Repository
2 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2023-46954

SQL Injection vulnerability in Relativity Server 2022 v.12.1.537.3 Patch 2 and earlier allows a remote attacker to execute arbitrary code via the name parameter.

[Vulnerability Type] SQL Injection

[Vendor of Product] Relativity ODA LLC

[Affected Product Code Base] Relativity Server 2022 v.12.1.537.3 Patch 2 and earlier

[Affected Component] POST /Relativity.Rest/API/Relativity.Users/workspace//users/retrieveusersby

[Attack Type] Remote

[Impact Code execution] true

[Attack Vectors] Within the JSON POST parameter 'Name', the following payload will return true and display a list of names and emails:

(SELECT (CASE WHEN (1=1) THEN 03586 ELSE 3*(SELECT 2 UNION ALL SELECT 1) END))

But the following payload will return false and display the message 'SQL Statement Failed':

(SELECT (CASE WHEN (1=2) THEN 03586 ELSE 3*(SELECT 2 UNION ALL SELECT 1) END))

Note: the True/False comparison takes place within the CASE WHEN () clause.

[Reference] https://www.linkedin.com/in/jakedmurphy1/

[Has vendor confirmed or acknowledged the vulnerability?] true

[Discoverer] Jake Murphy

Download Tool