CVE-2022-48604

Vulnerability

A SQL injection vulnerability exists in the “logging export” feature of ScienceLogic SL1 versions 11.1.2 and earlier. The feature takes unsanitized user-controlled input and passes it directly to a SQL query, allowing for the injection of arbitrary SQL before execution against the database [1].

Exploitation

An authenticated attacker with access to the logging export feature can craft a malicious request containing SQL injection payloads. No additional privileges or user interaction are required beyond the necessary authentication to access the feature. The attacker can send the crafted request to the vulnerable endpoint, injecting SQL commands that are then executed by the database [1].

Impact

Successful exploitation allows the attacker to execute arbitrary SQL commands on the underlying database. This can lead to unauthorized reading, modification, or deletion of sensitive data. In some scenarios, the attacker may be able to escalate privileges or compromise the entire database, depending on the database user permissions [1].

Mitigation

The vendor has released an update for ScienceLogic SL1 that addresses this vulnerability. Affected users should upgrade to the latest version of ScienceLogic SL1 (beyond 11.1.2). No workarounds are documented, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog [1].