published November 15, 2021
NVD has not assigned a CVSS score to this record. It sits in the 99.3th percentile for exploit probability.
⚠️ Here’s a sneaky SQL injection hiding in plain sight! This vulnerability in ResourceSpace can let remote attackers execute arbitrary SQL commands, no authentication required! 🔥 Think of this vulnerability like a restaurant where the chef is so overwhelmed, they start taking orders without checking IDs — anyone can just walk up and request anything from the menu! In this case, the 'menu' is your entire ResourceSpace database, including sensitive session cookies. An attacker could potentially uncover the complete content of the ResourceSpace database and hijack admin sessions. With access to session cookies, they could perform arbitrary actions on the server, leading to a total compromise of your system and its data.
Think of this vulnerability like a restaurant where the chef is so overwhelmed, they start taking orders without checking IDs — anyone can just walk up and request anything from the menu! In this case, the 'menu' is your entire ResourceSpace database, including sensitive session cookies. This SQL injection flaw resides in the add_keyword.php file, where an attacker can manipulate the 'k' parameter to execute harmful SQL commands, exposing sensitive information and allowing unauthorized access.
An attacker could potentially uncover the complete content of the ResourceSpace database and hijack admin sessions. With access to session cookies, they could perform arbitrary actions on the server, leading to a total compromise of your system and its data. Update ResourceSpace to version 9.6 (rev 18274 or higher) immediately. Additionally, review your database security measures and implement input validation to mitigate such injection risks in the future. You've got this! With these steps, you'll be on your way to securing your ResourceSpace installation in no time! 🛡️