Critical · published January 4, 2022
🚨 SQL injection is lurking in USOC, allowing unauthorized access to your database by simply searching! 🔥 Think of it like a library where only a select few can access certain books, but one of them found a way to slip in a fake search request that opens every vault in the library. They can read, change, or even delete anything they want! An attacker could potentially manipulate your database and gain complete control over sensitive information. Since only site admins can search, this makes it especially alarming—an admin's search could unwittingly execute an attack that compromises the entire system!
Think of it like a library where only a select few can access certain books, but one of them found a way to slip in a fake search request that opens every vault in the library. They can read, change, or even delete anything they want! This vulnerability allows SQL injection through unsanitized input in the usersearch.php file, enabling an attacker to run arbitrary SQL commands and interact with the database directly.
An attacker could potentially manipulate your database and gain complete control over sensitive information. Since only site admins can search, this makes it especially alarming—an admin's search could unwittingly execute an attack that compromises the entire system! Upgrade USOC to the latest version immediately, as there are no workarounds for this issue. Ensure that all input fields are properly sanitized to mitigate SQL injection risks in the future. This one’s fixable! Update now and you'll be back on track in no time. 🛡️