CVE-2023-42405: SQL Injection
Published Sep 14, 2023
·Updated
SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the sort parameter to taskService.list(), bareMetalService.list(), and switchService.list().
Affected Software
1 affected component
FIT2CLOUD RackShift=1.7.1
Event History
Sep 14, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the CVE ID for this vulnerability?
The CVE ID for this vulnerability is CVE-2023-42405.
2
What is the severity of CVE-2023-42405?
The severity of CVE-2023-42405 is critical with a score of 9.8.
3
How can an attacker exploit CVE-2023-42405?
An attacker can exploit CVE-2023-42405 by injecting SQL code via the 'sort' parameter to taskService.list(), bareMetalService.list(), and switchService.list().
4
How can I mitigate CVE-2023-42405?
To mitigate CVE-2023-42405, ensure that user input is properly validated and sanitized before being used in SQL queries.
5
Is there any reference for CVE-2023-42405?
Yes, you can find the reference for CVE-2023-42405 at https://github.com/fit2cloud/rackshift/issues/79.