PT-2023-17087 · Datagear · Datagear

Yangyanglo · Publicado 2023-03-22 · Atualizado 2024-05-17 · CVE-2023-1571

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataGear versions up to 4.5.0

Description A critical issue was found in DataGear, affecting an unknown part of the file /analysisProject/pagingQueryData. The manipulation of the queryOrder argument leads to sql injection. It is possible to initiate the attack remotely.

Recommendations For versions up to 4.5.0, upgrade to version 4.5.1 to address this issue. As a temporary workaround, consider restricting access to the /analysisProject/pagingQueryData endpoint until the issue is resolved. Avoid using the queryOrder argument in the affected endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-1571

Produtos afetados

Datagear

Referências · 6

• 🔥 https://github.com/yangyanglo/ForCVE/blob/main/2023-0x01.md · Exploit
• https://vuldb.com/?ctiid.223563 · Nota
• https://t.me/cibsecurity/60476 · Publicação no Telegram
• https://vuldb.com/?id.223563 · Nota
• https://osv.dev/vulnerability/CVE-2023-1571 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-1571 · Nota de Segurança