ArmorX Global Technology Corporation ArmorX Spam - SQL Injectoin

Vulnerability

ArmorX Global Technology Corporation ArmorX Spam version 8.15.2-2.872.088-1.90.027 and earlier contains an SQL injection vulnerability due to insufficient validation of user input within a special function [1]. An unauthenticated remote attacker can exploit this flaw without any prior authentication or special privileges [1].

Exploitation

An attacker, positioned anywhere on the network, crafts malicious SQL commands embedded in input to the vulnerable function. No authentication or user interaction is required. The attacker can send specially crafted HTTP requests to trigger the SQL injection and execute arbitrary SQL statements against the backend database [1].

Impact

Successful exploitation allows the attacker to read, modify, and delete arbitrary data in the database, leading to complete compromise of confidentiality, integrity, and availability of the affected system [1].

Mitigation

The vendor released version 8.15.2-2.922.096-1.90.033 on 2023-12-15 to fix the vulnerability. Users should upgrade to this or later version immediately [1]. No workaround is documented in the available references.