Skip to main content

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2023-52290

High
8.1/10

Summary

In streampark-console, list pages (e.g., the application page) allow users to sort data by specific fields. This sort field is sent from the frontend to the backend, and the SQL query is generated using this value. However, because the sort field is not properly validated, there is a risk of SQL injection. To exploit this vulnerability, an attacker must be successfully logged into the system. While this may lead to data leakage, no data is written or modified, making it a low-impact vulnerability. This issue affects versions 2.x prior to 2.1.4. Mitigation: All users should upgrade to version 2.1.4, where such parameters are properly validated and blocked.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-89 - SQL Injection

Structured Query Language (SQL) injection attacks are one of the most common types of vulnerabilities. They exploit weaknesses in vulnerable applications to gain unauthorized access to backend databases. This often occurs when an attacker enters unexpected SQL syntax in an input field. The resulting SQL statement behaves in the background in an unintended manner, which allows the possibility of unauthorized data retrieval, data modification, execution of database administration operations, and execution of commands on the operating system.

References

Advisory Timeline

  • Published