An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clau...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Ubuntu:Pro:16.04:LTS civicrm

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:18.04:LTS civicrm

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:20.04:LTS civicrm

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:22.04:LTS civicrm

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

参照URL

report ubuntu.com
report cve.org