Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-72558 →

UBUNTU-CVE-2026-72558

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clau...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Ubuntu:Pro:16.04:LTS civicrm

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:18.04:LTS civicrm

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:20.04:LTS civicrm

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:22.04:LTS civicrm

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Références

report ubuntu.com
report cve.org