CVE-2014-4824

Vulnerability

IBM QRadar SIEM versions 7.2 before 7.2.3 Patch 1 contain a SQL injection vulnerability in an unspecified component. The vulnerability allows remote authenticated users to inject arbitrary SQL commands into the back-end database via specially crafted input [1]. The issue is present in the 7.2 MR2 release and earlier builds.

Exploitation

An attacker must have valid authentication credentials for the QRadar SIEM web interface. No local network access or specialized knowledge is required. The attacker sends crafted SQL statements through the application's input vectors, which are not properly sanitized, leading to execution of arbitrary SQL commands on the database server [1].

Impact

Successful exploitation allows the attacker to view, add, modify, or delete information in the back-end database. This compromises the confidentiality, integrity, and availability of the system. The CVSS base score is 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P) [1].

Mitigation

IBM released QRadar SIEM 7.2.3 Patch 1 to address this vulnerability. Users should upgrade to version 7.2.3 Patch 1 or later. The security bulletin was published on September 15, 2014 [1]. No workarounds are documented in the available references.