Over 10 years we help companies reach their financial and branding goals. Engitech is a values-driven technology agency dedicated.

Gallery

Contacts

411 University St, Seattle, USA

engitech@oceanthemes.net

+1 -800-456-478-23

Twitter Facebook-f Pinterest-p Instagram

MISP – Time-based SQL injection in /Logs/index

DATE

13.09.2023

Affected Vendor

CIRCL – Computer Incident Response Center Luxembourg

Affected Product

MISP – Malware Information Sharing Platform & Open Standards For Threat Information Sharing – https://www.misp-project.org/

Vulnerable version

2.4.175

Fixed version

2.4.176

CVSS

7.2 High CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Recommendations

Upgrade to the recent MISP version

Vulnerability details

A key of the request POST body parameter in certain endpoints is inserted into an SQL query without proper escaping or validation. Authenticated adversaries can exploit this vulnerability by conducting time-based SQL injection attacks and get access to various information from the database including password hashes, API keys, and other.

CVE

CVE-2023-48657, CVE-2023-48658

Credits

Dawid Czarnecki

References

CVE-2023-48657:

CVE-2023-48658:

 

Do you think the security of your data might be lacking? Let's find the best approach together.
Once you contact us, we will ask you about the project you want to secure.

NEED A CONSULTATION?

Contact Us