CVE-2019-10664 in Domoticz
Summary
by MITRE
Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/14/2025
This vulnerability exists in Domoticz versions prior to 4.10578 and represents a critical sql injection flaw within the web server component. The vulnerability specifically affects the CWebServer::GetFloorplanImage function in WebServer.cpp where the idx parameter is improperly handled without adequate input validation or sanitization. The flaw occurs when user-supplied data from the idx parameter is directly incorporated into sql queries without proper escaping or parameterization, creating an avenue for malicious actors to inject arbitrary sql commands into the database layer.
The technical implementation of this vulnerability stems from insufficient input sanitization practices within the web server's floorplan image retrieval functionality. When a user requests a floorplan image, the idx parameter containing potentially malicious input is processed through the GetFloorplanImage method without proper security controls. This allows an attacker to craft sql injection payloads that can manipulate the underlying database queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability falls under the CWE-89 category of sql injection, which is classified as a high-risk security flaw in the CWE top 25 most dangerous software weaknesses.
The operational impact of this vulnerability extends beyond simple data theft as it can enable complete database compromise. An attacker could leverage this flaw to extract sensitive information such as user credentials, device configurations, and personal data stored within the Domoticz system. The vulnerability is particularly concerning in home automation environments where Domoticz systems may contain information about users' daily routines, security device configurations, and network access details. Additionally, the attacker could potentially escalate privileges within the database, modify system configurations, or even execute arbitrary code on the underlying system if proper database security measures are not in place.
Mitigation strategies for this vulnerability require immediate patching of Domoticz installations to version 4.10578 or later where the sql injection flaw has been addressed. Organizations should implement proper input validation and parameterized queries throughout their web applications to prevent similar issues. The fix should involve sanitizing all user inputs including the idx parameter through proper escaping mechanisms or using prepared statements with parameter binding. Security monitoring should be enhanced to detect unusual database query patterns that may indicate sql injection attempts. Additionally, implementing web application firewalls and database activity monitoring solutions can provide additional layers of protection. This vulnerability aligns with ATT&CK technique T1071.004 for application layer protocol and T1213.002 for data from information repositories, highlighting the need for comprehensive security controls around database access and application input handling.