Sql injection

2023-05-2416:15:00

PRIOn knowledge base

www.prio-n.com

sql injection

liferay portal

dxp

upgrade process

vulnerability

sql server

arbitrary commands

8.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.6%

JSON

SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table’s primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded.

CPENameOperatorVersion
digital_experience_platformeq7.3 fixpack1
digital_experience_platformeq7.3
digital_experience_platformeq7.3 fixpack2
digital_experience_platformeq7.4 update1
digital_experience_platformeq7.4
liferay_portalge7.3.1
liferay_portalle7.4.3.17

Name	Operator	Version
digital_experience_platform	eq	7.3 fixpack1
digital_experience_platform	eq	7.3
digital_experience_platform	eq	7.3 fixpack2
digital_experience_platform	eq	7.4 update1
digital_experience_platform	eq	7.4
liferay_portal	ge	7.3.1
liferay_portal	le	7.4.3.17