Impact
The advanced search was subject to an attack by SQL injection. A malicious user with admin rights could forge a request and alter the sort parameters in order to execute a SQL request, such as a DELETE statement.
The attack is difficult to exploit by an external attacker as a POST request must be performed and the session cookies are not sent if the HTTP request is performed from outside AgentJ thanks to the SameSite policy.
Patches
Admin are encouraged to update to AgentJ >= 2.1.6
References
#236
Impact
The advanced search was subject to an attack by SQL injection. A malicious user with admin rights could forge a request and alter the sort parameters in order to execute a SQL request, such as a DELETE statement.
The attack is difficult to exploit by an external attacker as a POST request must be performed and the session cookies are not sent if the HTTP request is performed from outside AgentJ thanks to the
SameSitepolicy.Patches
Admin are encouraged to update to AgentJ >= 2.1.6
References
#236