CVE-2023-51805

Name of the Vulnerable Software and Affected Versions TDuckCLoud tduck-platform version 4.0

Description The issue allows a remote attacker to obtain sensitive information via the getFormKey parameter in the search function of the FormDataMysqlService.java file. This is a SQL Injection vulnerability.

Recommendations For TDuckCLoud tduck-platform version 4.0, consider restricting access to the getFormKey parameter in the search function of the FormDataMysqlService.java file until a patch is available. As a temporary workaround, avoid using the getFormKey parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.