CVE-2023-26440

Vulnerability

The cacheservice API in OX App Suite is susceptible to SQL injection due to insufficient sanitization of parameters used when creating new cache groups. Attackers can indirectly inject SQL syntax through API calls, which is later executed. The vulnerability affects versions prior to the fix implemented by the vendor. [1]

Exploitation

An attacker with access to a local or restricted network can craft malicious API requests to the cacheservice endpoint. By injecting SQL syntax into parameters intended for cache group creation, the attacker can trigger arbitrary SQL execution. No user interaction is required beyond network access. [1]

Impact

Successful exploitation allows the attacker to perform arbitrary SQL queries against the underlying database. This can lead to unauthorized disclosure, modification, or deletion of data, potentially compromising the confidentiality, integrity, and availability of the application. [1]

Mitigation

The vendor has improved input validation and filtering for API calls to prevent SQL injection. Users should update to the latest patched version of OX App Suite. No publicly available exploits are known, and no workarounds have been disclosed. [1]