Wade Sparks

An SQL Injection issue exists in the dashboard widget data API endpoint '/api/data/{type}'. This occurs because chart filter parameters provided by the client are not properly validated before being used in database queries that generate dashboard chart data. An authenticated user with API access can use blind SQL injection—a technique used to retrieve data from a database by asking true/false questions—to read arbitrary information from the database, including contact details, marketing data, and user account password hashes. Additionally, the injected SQL can be used to slow down queries, potentially impacting availability. Data modification is not possible, and exploitation requires the Mautic API to be enabled.

A broken access control issue exists in the Mautic Stats API endpoint '/api/stats/{table}'. The system failed to enforce permissions for several internal tables, as administrator-only restrictions were not applied and tables lacking explicit permission mappings remained readable by default. Consequently, any authenticated API user, regardless of their assigned role or permissions, can access sensitive data. This includes the application audit log containing user actions and change details that may expose personal contact data, visitor IP addresses, geolocation details, and tracked redirect URLs with channel mappings.

Rancher Manager contains a flaw in its SAML assertion replay protection. Consumed assertion IDs are recorded in a per-process cache, meaning each replica only detects replays that reach the same pod. In high-availability deployments, an attacker with a captured assertion can replay it against every other replica to obtain multiple authenticated sessions as the victim.