Unauthenticated SQL Injection In IDAttend’s IDWeb Application

Vulnerability

An unauthenticated SQL injection vulnerability exists in the GetExcursionDetails method of IDAttend's IDWeb application. Affected versions are 3.1.052 and earlier, with discovery in version 3.1.013 [1]. The vulnerability allows an attacker to inject arbitrary SQL queries without requiring authentication.

Exploitation

An attacker needs network access to the IDWeb application. No authentication is required. The attacker can send crafted input to the GetExcursionDetails endpoint, injecting SQL commands. The exact exploitation steps are not detailed in the available reference, but standard SQL injection techniques apply.

Impact

Successful exploitation enables extraction or modification of all data in the database. This includes sensitive information, and the attacker can potentially alter or delete data. The impact is high confidentiality and integrity compromise.

Mitigation

The vulnerability is fixed in version 3.1.053 [1]. Users should upgrade to this version or later. No workarounds are mentioned in the reference. The application is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of publication.