CVE-2023-6191 is a Critical SQL injection (CVSS 9.8) in Egehan Security WebPDKS, covering every release through 20240329. The vendor did not respond to the disclosure, and the record names no fixed version. Restrict access to the application and contact the vendor and the Turkish national CERT.
What's affected
The record states that the issue affects WebPDKS through 20240329. That is a build identifier that reads like a date, and the record gives no earlier boundary, so assume every version up to and including it is affected.
- Fixed version: none is named in the record or in the references I could retrieve.
- Severity: CVSS 9.8 Critical, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That is network reachable, low complexity, no privileges and no user interaction. - Vendor response: the record notes that the vendor was contacted early about the disclosure and did not respond in any way.
The advisory is published by Turkey's national cyber security authority (USOM) as notice TR-24-0253. The notice pages were not rendered to a readable form when I fetched them, so this post relies on the NVD text. Check the notice yourself for any later vendor statement.
How to check if you're exposed
WebPDKS appears to be a web based personnel attendance and access control product. The record does not describe deployment details, so confirm with your facilities or HR systems owner whether it is installed.
- Search your asset inventory and procurement records for the product name.
- Look at web server and reverse proxy logs for the application and note which networks can reach it.
- Review database logs and application logs for unexpected query errors or unusual database activity on the application's data store.
If the application is reachable from the internet, treat that as the first problem to fix, regardless of the CVE.
What to do now
- Take the application off the public internet. Put it behind a VPN or an allowlist of known office addresses.
- Place a web application firewall rule set with SQL injection detection in front of it as a stopgap, and understand that this reduces risk without removing the bug.
- Make sure the application's database account has only the permissions it needs, and that it cannot read other databases on the same server.
- Contact Egehan Security and ask in writing for a patched release or a statement. Keep the reply for your risk register.
- Plan a replacement or a compensating control if no fix arrives, and record the risk acceptance with an owner and a review date.
Why it matters
The weakness is CWE-89, improper neutralization of special elements in an SQL command. The application builds a database query from input without keeping data separate from query structure, so crafted input can change what the query does. The result can include reading, changing or deleting records in the database behind the application, which for an attendance system means employee data.
What makes this entry awkward is the missing fix. Most posts in this series end with a version to upgrade to. Here the honest answer is that no patch is documented, which turns the guidance into network exposure control and vendor pressure. The kev flag in the record is false, and nothing I retrieved says the flaw is exploited in the wild.
Quick check
Is there a patch for CVE-2023-6191?
None is named in the record. The vendor is reported not to have replied to the disclosure, so ask the vendor directly and check the USOM notice for updates.
What is the quickest way to reduce risk?
Remove internet access to the application and restrict it to trusted networks, then limit the database account's permissions.
Sources
- USOM notice TR-24-0253
- Siber Guvenlik Baskanligi notice
- NVD record for CVE-2023-6191 (the notice pages did not render readable text when fetched)
Last reviewed: 19 October 2026.
