Critical · published January 9, 2025
🚨 An authenticated user can craft a query that runs arbitrary SQL — like giving a mischievous guest the chef's secret recipe book! 🔥 Think of it as a restaurant where the customers can ask the chef for any dish and, without proper checks, they get the secret sauce recipe instead of just their meal. This vulnerability allows an authenticated user to manipulate the filters to extract sensitive data simply by altering the input. An attacker could execute malicious SQL commands, potentially leading to data leakage, modification, or even deletion of critical information. This could be absolutely devastating for your customer engagement data and could compromise the integrity of your entire database!
Think of it as a restaurant where the customers can ask the chef for any dish and, without proper checks, they get the secret sauce recipe instead of just their meal. This vulnerability allows an authenticated user to manipulate the filters to extract sensitive data simply by altering the input. CVE-2025-21628 is a vulnerability in Chatwoot prior to version 3.16.0, where the conversation and contact filters do not sanitize the input of the 'query_operator' parameter. This oversight allows authenticated users to inject SQL code through a tautological WHERE clause.
An attacker could execute malicious SQL commands, potentially leading to data leakage, modification, or even deletion of critical information. This could be absolutely devastating for your customer engagement data and could compromise the integrity of your entire database! Immediate action is required! Upgrade Chatwoot to version 3.16.0 or later to patch this vulnerability and ensure your inputs are sanitized properly. Regularly audit any custom code interacting with these endpoints to prevent similar issues in the future. You've got this! By taking these steps, you're locking down your application and bolstering your security defenses like a pro. 🛡️