CVE-2018-15868

Vulnerability

ChronoScan version 1.5.4.3 and earlier [1] contains a SQL injection vulnerability in the handling of the wcr_machineid cookie. An unauthenticated attacker can inject arbitrary SQL commands through this cookie parameter without requiring any prior authentication or special configuration.

Exploitation

The attacker sends a crafted HTTP request to a ChronoScan instance with a malicious wcr_machineid cookie value containing SQL syntax. No authentication or user interaction is required; the vulnerability is reachable over the network by any unauthenticated client.

Impact

Successful exploitation allows the attacker to execute arbitrary SQL commands against the underlying database. This can lead to unauthorized reading, modification, or deletion of data, including potentially sensitive information stored by the application.

Mitigation

As of the publication date (2019-06-21), no patched version has been disclosed in the available references [1]. Users should monitor the vendor's site for updates or consider restricting network access to ChronoScan instances until a fix is applied.