PT-2024-40538 · Silverstripe · Silverstripe

Published 2024-05-27 · Updated 2024-05-27

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SilverStripe versions 4.0.0 SilverStripe versions 3.5 through 3.6

Description: The issue is related to a possible SQL injection vulnerability when performing a fulltext search. Specifically, the start querystring parameter is not escaped safely. In versions 3.5 and 3.6, the SearchForm sanitises these variables prior to passing to mysql, making them less vulnerable.

Recommendations: For SilverStripe version 4.0.0, ensure the start querystring parameter is properly escaped to prevent SQL injection. For SilverStripe versions 3.5 through 3.6, consider additional validation for the start parameter to further reduce the risk of exploitation, although SearchForm already provides some sanitisation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

GHSA-XX4R-5265-48J6

Affected Products

Silverstripe

References · 6

• https://osv.dev/vulnerability/GHSA-xx4r-5265-48j6 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2017-008-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/a8465900bdc77199176c953890ce7587045b1ea4 · Note
• https://github.com/silverstripe/silverstripe-framework/commit/099a5a3c2d99ed39bdd8815e1e2790bb9351770b · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2017-008 · Note