CVE-2019-10664: SQL Injection

Q: Which deployments are exposed to this issue?

Domoticz versions before 4.10578 are affected. The vulnerable endpoint is part of the web server functionality.

Q: Does an attacker need an account or user interaction to exploit it?

No. The CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the impact if exploitation succeeds?

The CVSS assessment rates confidentiality, integrity, and availability impact as high. The referenced exploit material describes unauthenticated remote command execution.

Q: What should be done to remediate the issue?

Apply the available patch by upgrading to Domoticz 4.10578 or later.

Published Mar 31, 2019

Updated

Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.

Affected Software

1 affected component

Domoticz Domoticz<4.10578

Remediation

Patch Available

https://github.com/domoticz/domoticz/commit/ee70db46f81afa582c96b887b73bcd2a86feda00

Event History

Mar 31, 2019

CVE Published

via MITRE·01:14 PM

Data Sourced

via MITRE·01:14 PM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

Domoticz versions before 4.10578 are affected. The vulnerable endpoint is part of the web server functionality.

Does an attacker need an account or user interaction to exploit it?

No. The CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the impact if exploitation succeeds?

The CVSS assessment rates confidentiality, integrity, and availability impact as high. The referenced exploit material describes unauthenticated remote command execution.

What should be done to remediate the issue?

Apply the available patch by upgrading to Domoticz 4.10578 or later.

CVE-2019-10664: SQL Injection

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does an attacker need an account or user interaction to exploit it?

What is the impact if exploitation succeeds?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does an attacker need an account or user interaction to exploit it?

What is the impact if exploitation succeeds?

What should be done to remediate the issue?