CVE-2014-8083: SQL Injection

Q: Which deployments are affected?

OSClass versions before 3.4.3 are affected. The issue is reachable remotely through the alert parameter used in a search alert subscription action.

Q: Does exploitation require authentication or special conditions?

No authentication is required. The reported vector is network-accessible and has low attack complexity.

Q: What is the impact of successful exploitation?

An attacker can execute arbitrary SQL commands, with potential impact to the confidentiality, integrity, and availability of the affected application's data.

Q: What should administrators do?

Apply the available patch by upgrading to OSClass 3.4.3 or later. The provided data does not identify a workaround for deployments that cannot be patched immediately.

Published Jan 5, 2015

Updated

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action.

Affected Software

1 affected component

OSClass Osclass<=3.4.2

Remediation

Patch Available

http://blog.osclass.org/2014/10/09/osclass-3-4-3-ready-download/

Event History

Jan 5, 2015

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

Which deployments are affected?

OSClass versions before 3.4.3 are affected. The issue is reachable remotely through the alert parameter used in a search alert subscription action.

Does exploitation require authentication or special conditions?

No authentication is required. The reported vector is network-accessible and has low attack complexity.

What is the impact of successful exploitation?

An attacker can execute arbitrary SQL commands, with potential impact to the confidentiality, integrity, and availability of the affected application's data.

What should administrators do?

Apply the available patch by upgrading to OSClass 3.4.3 or later. The provided data does not identify a workaround for deployments that cannot be patched immediately.

CVE-2014-8083: SQL Injection

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or special conditions?

What is the impact of successful exploitation?

What should administrators do?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or special conditions?

What is the impact of successful exploitation?

What should administrators do?