CVE-2023-2809

CVE-2023-2809 is a critical plaintext credential usage vulnerability affecting Sage 200 Spain version 2023.38.001. A remote attacker can exploit this flaw to extract SQL database credentials, potentially leading to remote execution of MS SQL commands and privilege escalation on Windows systems. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with low complexity and no user interaction, resulting in complete compromise of confidentiality, integrity, and availability. While no public exploits or active exploitation have been observed, and community discussion is minimal, the high severity warrants immediate attention.