CVE-2022-24956

Name of the Vulnerable Software and Affected Versions Shopware B2B-Suite versions through 4.4.1

Description The issue allows a remote authenticated attacker to dump the underlying database through SQL injection in the sort-by parameter of the search functionality of b2border and b2borderlist. Possible techniques include boolean-based blind, time-based blind, and potentially stacked queries.

Recommendations For versions through 4.4.1, consider restricting access to the search functionality of b2border and b2borderlist until a patch is available. As a temporary workaround, avoid using the sort-by parameter in the affected search functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.