High · published November 27, 2025
⚡ An SQL injection flaw lurking in the last usage logs of Devolutions Server could open the door to some serious mischief! 🤖 Think of this as a restaurant where a customer can sneak into the kitchen by simply asking for a special ingredient. If they know just the right questions to ask, they could manipulate the menu to get whatever they want! 🍽️ An attacker could exploit this vulnerability to gain unauthorized access to sensitive data, potentially querying any data stored in the database. This could lead to data breaches or data loss, making it extremely important to address swiftly! 🔥
Think of this as a restaurant where a customer can sneak into the kitchen by simply asking for a special ingredient. If they know just the right questions to ask, they could manipulate the menu to get whatever they want! 🍽️ This SQL injection vulnerability allows an attacker to manipulate database queries by injecting malicious SQL code through the last usage logs. Affected versions include Devolutions Server through 2025.2.20 and 2025.3.8, which could lead to unauthorized data access.
An attacker could exploit this vulnerability to gain unauthorized access to sensitive data, potentially querying any data stored in the database. This could lead to data breaches or data loss, making it extremely important to address swiftly! 🔥 To remediate this issue, immediately update Devolutions Server to the latest version that patches this vulnerability. Additionally, implement input validation and prepared statements to mitigate SQL injection risks in the future. 🛡️ You've got this! Stay proactive, and you'll keep your data safe and sound! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| devolutions/devolutions_server | < 2025.2.21.0 | 2025.2.21.0 |
| devolutions/devolutions_server | ≥ 2025.3.2.0, < 2025.3.10.0 | 2025.3.10.0 |