CVE-2022-48601

Vulnerability

A SQL injection vulnerability exists in the “network print report” feature of ScienceLogic SL1 versions 11.1.2 and earlier. The feature takes unsanitized user-controlled input and passes it directly to a SQL query, allowing for the injection of arbitrary SQL before execution against the database [1].

Exploitation

An attacker can exploit this vulnerability by providing crafted input to the network print report feature. No authentication is required, as the feature is accessible to unauthenticated users. The input is not sanitized and is directly concatenated into a SQL query, enabling the attacker to inject malicious SQL commands [1].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands against the database. This can lead to unauthorized access, modification, or deletion of data, potentially resulting in full compromise of the application and underlying data [1].

Mitigation

ScienceLogic has released an update to address this vulnerability. Users should upgrade to the latest version of ScienceLogic SL1 (beyond 11.1.2). No other workarounds have been disclosed [1].