PT-2023-15863 · Sciencelogic · Sciencelogic Sl1

B0Yd + 1 · Published 2023-08-09 · Updated 2023-08-11 · CVE-2022-48591

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ScienceLogic SL1 (affected versions not specified)

Description A SQL injection issue exists in the vendor state parameter of the "vendor print report" feature, allowing arbitrary SQL injection before execution against the database. This occurs because the feature takes unsanitized user-controlled input and passes it directly to a SQL query.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

SQL injection

Weakness Enumeration

CWE-78

CWE-89

Related Identifiers

CVE-2022-48591

Affected Products

Sciencelogic Sl1

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-48591 · Security Note
• https://osv.dev/vulnerability/CVE-2022-48591 · Vendor Advisory
• https://securifera.com/advisories/cve-2022-48591 · Note
• https://t.me/cvenotify/56155 · Telegram Post
• https://t.me/cibsecurity/68120 · Telegram Post