| शीर्षक | evergreen-ils evergreen 3.14.0 SQL Injection |
|---|
| विवरण | An unauthenticated SQL injection vulnerability exists in the "open-ils.fielder" OpenSRF service of Evergreen ILS. The vulnerable endpoint is publicly exposed via the HTTP gateway (GET /osrf-gateway-v1) and requires no authentication.
User-supplied JSON query values are passed to the SQL query builder without sufficient validation, allowing injection of arbitrary SQL expressions executed with the privileges of the Evergreen database user. Successful exploitation allows full read access to the database including patron PII, password reset tokens and financial data.
Fixed in versions 3.14.12, 3.15.12, 3.16.6, and 3.17-beta2. Versions prior to 3.14 have no patch available and should be upgraded to a supported branch.
References:
https://bugs.launchpad.net/evergreen/+bug/2147196
https://evergreen-ils.org/evergreen-security-release-3-14-12-3-15-12-3-16-6-3-17-beta2/ |
|---|
| स्रोत | ⚠️ https://bugs.launchpad.net/evergreen/+bug/2147196 |
|---|
| उपयोगकर्ता | hacklantic (UID 99334) |
|---|
| सबमिशन | 27/06/2026 03:08 PM (2 महीनों पहले) |
|---|
| संयम | 15/08/2026 07:32 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 390177 [Evergreen तक 3.14.11/3.15.11/3.16.5/3.17-beta1 open-ils.fielder OpenSRF Service /osrf-gateway-v1 SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|