Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in STER allows an authenticated user to inject malicious SQL commands through search filters. This could enable them to access or manipulate sensitive data that the application can reach.
- Sensitive data exposure is possible.
- Attackers view data of other users.
Attack Path
How an attacker could exploit the issue
An attacker with valid credentials can exploit this SQL injection flaw by manipulating input in the search filters. This allows them to bypass intended data restrictions and access or modify sensitive information that the application can reach.
- Authenticated user needed.
- Abuses search filters.
- Reads/writes other user data.
Live Threat
Current exploitation, exposure, and threat context
Attackers might find this SQL injection vulnerability appealing due to its potential to expose sensitive data. The requirement for authentication, however, could deter mass exploitation. Given the vulnerability is patched and not listed as actively exploited, the immediate threat is likely low.
- Exploitation requires authentication.
- Patch is available.
- No KEV listing.
Operational Fix
Recommended remediation, mitigation, and detection steps
Focus on identifying and blocking any network traffic attempting to exploit the SQL injection vulnerability in STER's search filters. Prioritize reviewing logs for unusual query patterns or access to sensitive data by authenticated users. If exploitation is detected, immediately isolate the affected instances until the vulnerability is patched.
- Block suspicious SQL queries.
- Update STER to version 9.5.
- Monitor for unauthorized data access.
