CVE-2023-38250: 
PHP vulnerability analysis and mitigation

Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier), and 2.4.4-p5 (and earlier) are affected by an SQL Injection vulnerability that could lead to arbitrary code execution. The vulnerability was assigned CVE-2023-38250 and was disclosed on October 13, 2023 (NVD).

The vulnerability is classified as an Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) with a CVSS v3.1 base score of 8.0 HIGH according to Adobe, and 6.6 MEDIUM according to NIST. The attack vector is network-based (AV:N) with high attack complexity (AC:H), requires high privileges (PR:H), and no user interaction (UI:N). The scope is changed according to Adobe's assessment (S:C) with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) (NVD).

If successfully exploited, this vulnerability could lead to arbitrary code execution by an admin-privilege authenticated attacker. The vulnerability affects multiple versions of Adobe Commerce and has high impact ratings for confidentiality, integrity, and availability (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update their Adobe Commerce installations to the latest patched versions (Adobe Advisory).