PT-2023-17087 · Datagear · Datagear

Yangyanglo · Published 2023-03-22 · Updated 2024-05-17 · CVE-2023-1571

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataGear versions up to 4.5.0

Description A critical issue was found in DataGear, affecting an unknown part of the file /analysisProject/pagingQueryData. The manipulation of the queryOrder argument leads to sql injection. It is possible to initiate the attack remotely.

Recommendations For versions up to 4.5.0, upgrade to version 4.5.1 to address this issue. As a temporary workaround, consider restricting access to the /analysisProject/pagingQueryData endpoint until the issue is resolved. Avoid using the queryOrder argument in the affected endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-1571

Affected Products

Datagear

References · 6

• 🔥 https://github.com/yangyanglo/ForCVE/blob/main/2023-0x01.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-1571 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1571 · Security Note
• https://vuldb.com/?ctiid.223563 · Note
• https://t.me/cibsecurity/60476 · Telegram Post
• https://vuldb.com/?id.223563 · Note