CVE-2023-6436 is a critical SQL injection in the Ekol Informatics Website Template, affecting releases through 20231215. The record gives a CVSS score of 9.8 and names no fixed version. Read the Turkish national notice TR-24-0001 and contact the vendor for an update.
What's affected
- Product: Ekol Informatics Website Template (the CPE name is web_sablonu_yazilimi).
- Affected: through 20231215, per the record.
- Fixed version: the record names none. The references are the USOM and Siber Guvenlik notices TR-24-0001.
- Access needed: none, over the network, with low complexity.
The record gives a CVSS 3.1 base score of 9.8 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
This is a vendor template without a public package name, so check with whoever built or hosts the site. Find the template version string or build date in your deployment, and compare it with 20231215.
If you cannot tell, treat the site as exposed. Look at the web server and application logs for requests that put quote characters or SQL keywords into query parameters.
What to do now
- Ask your web agency or host whether any site uses the Ekol Informatics Website Template.
- Read notice TR-24-0001 on usom.gov.tr and ask the vendor for a patched release.
- Until patched, put a web application firewall rule or access restriction in front of the affected site.
- Make sure the database account used by the site has only the rights it needs.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-89 (SQL Injection): User controlled values are placed into a database query without proper escaping or parameter binding, so the query text itself can be changed.
SQL injection is the case where user input becomes part of the query text instead of a bound value. The record gives no further detail than that, which is enough to know the class and the severity.
A 9.8 score tells you the shape of the risk. No login, a network path, low complexity, and full impact on the database. Sites built from templates are often forgotten once launched, so the work here is finding them. Add the template to your inventory so the next notice reaches someone.
Quick check
Is there a fixed version?
The record lists none. Contact the vendor and check notice TR-24-0001.
Why is it rated critical?
The vector needs no privileges or user interaction and has high confidentiality, integrity and availability impact, giving 9.8.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
