CVE-2023-47460 is a SQL injection flaw in Knovos Discovery 22.67.0, in the getGridColumnStructure admin service endpoint. NVD scores it 8.8, High, and says it can lead to code execution. I could not confirm a fixed version, so ask Knovos for one and limit who can reach the service.
What's affected
The record names Knovos Discovery version 22.67.0 only. The affected component is the service path /DiscoveryProcess/Service/Admin.svc/getGridColumnStructure. The weakness is CWE-89, SQL injection.
The researcher's repository describes the attack type as remote and the attack vector as an authorized user, which matches the Low privilege requirement in the NVD vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The repository lists code execution and information disclosure as impacts.
No vendor advisory is cited, and I could not confirm a fixed version. The vendor's site is the only other reference. Ask Knovos directly whether version 22.67.0 is still supported and which release resolves the issue.
Source note: the description says arbitrary code execution, but SQL injection by itself usually gives access to the database. Code execution then depends on the database configuration or other features. The report does not explain the step, so treat the code execution claim as the researcher's.
How to check if you're exposed
Check the product version in the Knovos Discovery administration screens or with your vendor contact. Version 22.67.0 is the one named.
Then find out who can reach the administration service. Review web server or reverse proxy logs for requests to the Admin.svc path from accounts or addresses that should not be using it. Unusual delays on that endpoint, or database errors in the application log, deserve a closer look.
I am not giving a command line check, as this is a hosted or on-premise commercial application and the layout differs by deployment.
What to do now
- Contact Knovos to ask for the fixed version, and apply it as soon as it is available.
- Limit access to the administration services to a trusted network or VPN, and remove accounts you do not need.
- Review database account privileges for the application, and reduce them to the minimum the application needs.
- Turn on logging for the administration service, and review the logs for the period since you installed 22.67.0.
- Ask whether your vendor has a vulnerability disclosure contact, and record it in your supplier register.
Why it matters
SQL injection, CWE-89, happens when an application builds a database query by joining text, including text from the request. The database then cannot tell data from instructions. The standard fix is a parameterised query, where the data travels separately from the command.
The record shows that this endpoint takes a request that includes a grid name and then uses it in a query. I will not repeat the request, but the class is old and well understood. What makes it worth attention is where it lives: an e-discovery platform holds legal and case data, and the people who use it care a great deal about who can see what.
Because the endpoint needs a signed-in account, the risk depends on who has accounts. Limit them, review them, and watch for use that does not match normal work.
Quick check
Is a patch available?
I could not confirm one. The record cites only the researcher's repository and the vendor's home page.
Does an attacker need an account?
The researcher describes the attack vector as an authorized user, and NVD's vector requires low privileges.
Sources
Last reviewed: 19 October 2026.
