Sql injection

2023-10-1223:15:00

PRIOn knowledge base

www.prio-n.com

sql injection

unauthenticated user

arbitrary sql statements

backend database server

9.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.2%

JSON

An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. The csvExportReport endpoint action generateCSV is vulnerable to SQL injection through the sorting parameter, allowing an unauthenticated user to execute arbitrary SQL statements in the context of the application’s backend database server.

CPENameOperatorVersion
scrutinizerlt19.3.1

CPE	Name	Operator	Version
	scrutinizer	lt	19.3.1

References

github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0001.md