CVE-2023-30465: Apache InLong: SQL injection in apache inLong 1.5.0
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.5.0. By manipulating the "orderType" parameter and the ordering of the returned content using an SQL injection attack, an attacker can extract the username of the user with ID 1 from the "user" table, one character at a time. Users are advised to upgrade to Apache InLong's 1.6.0 or cherry-pick [1] to solve it. https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html
[1] https://github.com/apache/inlong/issues/7529 https://github.com/apache/inlong/issues/7529
Other sources
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.5.0. By manipulating the "orderType" parameter and the ordering of the returned content using an SQL injection attack, an attacker can extract the username of the user with ID 1 from the "user" table, one character at a time. Users are advised to upgrade to Apache InLong's 1.6.0 or cherry-pick PR #7530 to solve it.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-30465.
What software does this vulnerability affect?
This vulnerability affects Apache InLong versions 1.4.0 through 1.5.0.
What is the severity of CVE-2023-30465?
The severity of CVE-2023-30465 is medium with a CVSS score of 5.3.
How does this vulnerability manifest?
This vulnerability is an SQL injection vulnerability in Apache InLong, which can be exploited by manipulating the 'orderType' parameter and the ordering of the returned content using an SQL command.
How can I mitigate CVE-2023-30465?
To mitigate CVE-2023-30465, it is recommended to update Apache InLong to version 1.5.1 or later, which contains a fix for this vulnerability.