Executive brief
NLB mKlik Macedonia is a mobile banking application used by customers of NLB Bank to view accounts and conduct financial transactions. A SQL injection vulnerability in the international transfer feature allows attackers to inject malicious code into database queries through unsanitized input, potentially exposing sensitive banking information stored in the application's database.
Technical details
The vulnerability is a SQL injection flaw (CWE-89) affecting the international transfer parameters in NLB mKlik Macedonia 3.3.12. Input passed to parameters associated with international transfer details and description fields is not properly sanitized before being used in SQL queries. An attacker can inject arbitrary SQL code via network-based attack without requiring authentication or user interaction to manipulate database queries and extract sensitive information such as account details and transaction records. The vulnerability was discovered in December 2022 and assigned advisory ID ZSL-2023-5797; patch availability is not documented in available references.
Affected products
- NLB Banka mKlik Macedonia 3.3.12
Timeline
- 2023-10-16: disclosed: Vulnerability published on CXSecurity
- 2022-12-23: advisory: Advisory ZSL-2023-5797 issued by Neurogenesia / ZeroScience