Lennart Hostettler

**Name of the Vulnerable Software and Affected Versions** Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1 **Description** An administrator with adequate entitlements can execute arbitrary SQL via stacked queries by leveraging unsanitized sort parameters. This is caused by improper neutralization of special elements used in an SQL command, commonly known as SQL Injection. **Recommendations** Upgrade versions 3.0.0-M0 through 3.0.16 to version 4.0.7. Upgrade versions 4.0.0-M0 through 4.0.6 to version 4.0.7. Upgrade versions 4.1.0-M0 through 4.1.1 to version 4.1.2.