#sql

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q53r-9hh9-w277. This link is maintained to preserve external references. ## Original Description A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functionality of the file /admin/customermanagementframework/customers/list. The manipulation of the argument filterDefinition/filter leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component.

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: DataMosaix Private Cloud Vulnerabilities: Exposure of Sensitive Information to an Unauthorized Actor, Dependency on Vulnerable Third-Party Component 2. RISK EVALUATION Successful exploitation of these vulnerabilities could overwrite reports, including user projects. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Rockwell Automation reports the following versions of DataMosaix Private Cloud are affected: DataEdgePlatform DataMosaix Private Cloud: Version 7.11 and prior (CVE-2025-0659) DataEdgePlatform DataMosaix Private Cloud: Versions 7.09 and prior (CVE-2020-11656) 3.2 VULNERABILITY OVERVIEW 3.2.1 Exposure of Sensitive Information to an Unauthorized Actor CWE-200 A path traversal vulnerability exists in DataMosaix Private Cloud. By specifying the character sequence in the body of the vulnerable endpoint, it is possible to overwrite files outside of the in...

Whether you're facing growing data demands and increased cyber threats, or simply looking to future-proof your business, it's time to consider the long-term benefits of transitioning to a cloud-first infrastructure.

Third-party API security requires a tailored approach for different scenarios. Learn how to adapt your security strategy to outbound data flows, inbound traffic, and SaaS-to-SaaS interconnections.

The threat actors are abusing the vulnerabilities to gain initial access, obtain credentials, and install malicious scripts on user devices.

### Impact This can not be exploited in a fresh install of PrestaShop, only shops made vulnerable by third party modules are concerned. For example, if your shop has a third party module vulnerable to SQL injections, then ps_contactinfo might execute a stored XSS in FO. ### Patches The long term fix is to have all your modules maintained and updated. The fix on ps_contactinfo will keep formatted addresses from displaying an xss stored in the database. ### Workarounds none ### References none

### Summary Content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. ### Details During a pentest, a security researcher was able to access environment variable data and other system data by using the `sniff_csv` function, even though we set `enable_external_access` to false. ### PoC ```SQL SET enable_external_access=false; SET lock_configuration=true; SELECT Columns FROM sniff_csv('/proc/self/environ'); ``` ### Impact Provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. For example `select * from read_csv('/proc/self/environ')` fails with a permission error. There seems to be two vectors to this vulnerability: 1. Access to files that should otherwise not be allowed. (We expect `Permission Error: Scanning CSV files is disabled through configuration` and not to provide any access to the file or even acknowledge that it exists). 2. The c...

### Summary Cross-site request forgery allows an unauthenticated attacker to hijack the authentication of a logged in user, and use the web API with the same permissions. ### Details Security attributes like HttpOnly and SameSite are missing from the session cookie, allowing its use from XHR requests and form submissions. The CodeChecker API endpoints only require the session cookie, they do not require a CSRF token, and missing HTTP headers allow the form submission to succeed (but not XHR). This means that the attacker needs to know the ID of products to edit or delete them, but it does not need knowledge to create new products with the SQLite backend. ### PoC With a superuser logged into CodeChecker. ```html <html><body> <form action="https://codechecker.example.com/v6.58/Products" method="POST" enctype="text/plain"> <input type="text" name='[1,"getProducts",1,1,{}]' value=''> </form> <script>document.forms[0].submit()</script> </body></html> ``` Or the same f...

An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.

WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.