Unauthenticated Remote Attackers Can Inject Arbitrary FetchXml Commands to Read, Modify, and Delete Database Content

CVE-2024-9982

Summary

The AIM LINE Marketing Platform from Esi Technology exhibits a vulnerability due to improper validation of a specific query parameter when the LINE Campaign Module is activated. This flaw allows unauthenticated remote attackers to inject arbitrary FetchXml commands, enabling them to read, modify, and delete database content. Such unauthorized actions can severely compromise the integrity and confidentiality of sensitive information within the platform. Implementing robust input validation and ensuring the LINE Campaign Module is securely configured are essential steps to mitigate this vulnerability.

References