Description
A vulnerability has been discovered in OpenX, which can be exploited
by malicious people to conduct SQL injection attacks.
Input passed via the "xajaxargs" parameter to
www/admin/updates-history.php (when "xajax" is set to "expandOSURow")
is not properly sanitised in e.g. the
"queryAuditBackupTablesByUpgradeId()" function
(lib/OA/Upgrade/DB_UpgradeAuditor.php) before being used in SQL
queries. This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code.
The vulnerability is confirmed in version 2.8.9. Prior versions may
also be affected.
Remediation
Update to version 2.8.10.
References
Related Vulnerabilities
MySQL CVE-2022-21368 Vulnerability (CVE-2022-21368)
MySQL CVE-2020-14845 Vulnerability (CVE-2020-14845)
Jboss EAP CVE-2018-8088 Vulnerability (CVE-2018-8088)
XWiki Exposure of Resource to Wrong Sphere Vulnerability (CVE-2023-29203)
Moodle Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2021-20187)