PT-2019-15564

CVE-2019-18663

Published

2019-11-04

Updated

2019-11-05

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ARP-GUARD version 4.0.0-5

Description A SQL injection issue allows unauthenticated remote attackers to execute arbitrary SQL commands. This is achieved via the user id parameter in a "/login/forgot1" POST request.

Recommendations For ARP-GUARD version 4.0.0-5, avoid using the user id parameter in the "/login/forgot1" API endpoint until the issue is resolved. As a temporary workaround, consider restricting access to this endpoint to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Pascal Keul

Patrick Muench

Torsten Löbner

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')