ezsystems/ezpublish-legacy has a SQL injection in dfscleanup

Vulnerability

The vulnerability exists in dfscleanup.php and the _getFileList function of the eZDFSFileHandlerMySQLiBackend class (kernel/private/classes/clusterfilehandlers/dfsbackends/mysqli.php) in eZ Publish Legacy. The bug is a union-based SQL injection reachable only from the command line. It is confirmed to affect the 2019.03 branch, with other branches possibly affected [1][2]. The software is past its end of life, with no plans to release a fix.

Exploitation

An attacker must have local shell access to the server and sufficient privileges to execute the dfscleanup.php script. With that access, the attacker can inject malicious SQL via a crafted union query in the _getFileList function, which interacts with the eZ Publish MySQL database [1][2]. No authentication or user interaction beyond having shell access is required.

Impact

Successful exploitation allows the attacker to read arbitrary data from the MySQL database, including potentially sensitive information such as user credentials. The attack results in information disclosure, compromising the confidentiality of the application's data. The attacker does not escalate privileges on the OS, only gains access to the database contents [1][2].

Mitigation

There is no fix available, and no workarounds are provided. The software (branch 2019.03 and likely others) is past its end of life and will not receive a security patch [1][2]. The only effective mitigation is to discontinue use of the product or ensure that no untrusted users have shell access to the server where it runs.