SQL Injection Vulnerability in Malware Scanner

CVE-2024-25902

Summary

The vulnerability in MiniOrange's Malware Scanner involves an improper neutralization of special characters used in SQL commands, leading to an SQL injection vulnerability. This issue affects versions of the Malware Scanner up to 4.7.2, enabling attackers to craft malicious SQL queries that can manipulate, extract, or delete sensitive data from the web application databases. Immediate remediation is essential for users of the affected product to safeguard their systems from potential exploitation.

References