GitHub Advisoryadvisory · Packagist

GHSA-jj6w-2cqg-7p94 Mautic SQL Injection in dynamic Reports

MEDIUM Published 2024-04-12 Modified 2024-09-18 Official page ↗
Aliases
CVE-2022-25775
Ecosystem
Packagist
Packages
mautic/core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2024-04-12

Affected packages

• Packagist mautic/core: >= 2.14.1, < 4.4.12 → fixed in 4.4.12 • Packagist mautic/core: >= 5.0.0-alpha, < 5.0.4 → fixed in 5.0.4

Description

Impact Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems. Patches Update to 4.4.12 or 5.0.4 Workarounds No References • https://owasp.org/www-community/attacks/SQL_Injection • https://owasp.org/www-community/attacks/Blind_SQL_Injection

Related

Alias · CVE (1)

  • CVE-2022-25775 Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References