CVE-2023-48118 is a critical (CVSS 9.8) SQL injection in Quest Analytics IQCRM version 2023.9.5, reachable through a crafted request to the Common.svc WSDL page. I found no vendor advisory or fixed version, so contact Quest Analytics and restrict exposure of the service until you have an answer.
What's affected
The record names a single product and version: Quest Analytics LLC IQCRM v.2023.9.5. The NVD description says a remote attacker can execute arbitrary code through a crafted request to the Common.svc WSDL page. The weakness is CWE-89 (SQL Injection).
The record scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, no account and no user action.
The references are the researcher's disclosure repository on GitHub and the vendor's home page. I did not find a vendor advisory, a release note or a version number that fixes the issue. That means there is no confirmed patched release to point you to, and later versions have not been confirmed as unaffected. The record does not flag the CVE as exploited in the wild. The description mentions code execution, which is a stronger outcome than SQL injection usually gives, so treat the impact claim as the reporter's and ask the vendor to confirm it.
How to check if you're exposed
IQCRM is a hosted or installed customer relationship product, so the first step is to find out whether you run it at all. Check your software inventory and procurement records for Quest Analytics and IQCRM, and ask the business owner which version is deployed.
If you operate an instance, read the version from the application's about or settings page, or from the vendor contact that manages it for you. Version 2023.9.5 is the one named in the record.
You can also check whether the service endpoint named in the record is reachable from outside your network. A request to the web service's WSDL page from an external address tells you whether the surface is exposed. Do this only against systems you own or are authorised to test.
What to do now
- Confirm whether IQCRM is in use and which version is deployed.
- Contact Quest Analytics and ask in writing whether CVE-2023-48118 is fixed, and in which release.
- Restrict access to the web service to the networks that need it, using a firewall or a web application firewall rule.
- Review database permissions for the application account so that it cannot read or change more than it must.
- Check logs for unusual requests to the service endpoint and for database errors around that time.
Why it matters
SQL injection happens when user supplied input is placed into a database query without being kept separate from the query text. The fix pattern is well known: parameterised queries, input validation and a database account with narrow rights. A flaw reachable with no login in a customer data system is the reason the score is near the top of the scale.
Web service description pages and service endpoints are often forgotten in testing because they are not part of the visible user interface. Scanning a running application with a dynamic test helps catch this class, and your dependency inventory helps you know which third party applications you depend on in the first place. See the Safeguard Gold page for this CVE for the record.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch for CVE-2023-48118?
I did not find one. The record and its references name no fixed version, so ask the vendor.
Does the attacker need to log in?
No. The record vector needs no privileges and no user interaction.
Sources
Last reviewed: 19 October 2026.
