CVE-2023-2567 – Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0

https://notcve.org/view.php?id=CVE-2023-2567

A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query functionality, allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application. Authenticated users can extract arbitrary information from the DBMS in an uncontrolled way. Vulnerabilidad de inyección SQL en Nozomi Networks Guardian y CMC, debido a una validación de entrada incorrecta en ciertos parámetros utilizados en la funcionalidad de consulta, permite a un atacante autenticado ejecutar consultas SQL arbitrarias en el DBMS utilizado por la aplicación web. Los usuarios autenticados pueden extraer información arbitraria del DBMS de forma incontrolada. A SQL Injection vulnerability has been found in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query functionality. Authenticated users may be able to execute arbitrary SQL statements on the DBMS used by the web application. • https://security.nozominetworks.com/NN-2023:9-01 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •