Critical · published September 10, 2025
🚨 A sneaky SQL injection lurks in the PartyBooking component of rAthena, putting your MMORPG server at serious risk! 🔥 Think of it like a party invitation with a hidden clause that lets party crashers sneak in unnoticed — attackers can manipulate the `WorldName` parameter and gain unauthorized access to your database! If exploited, this vulnerability could allow attackers to execute arbitrary SQL commands, potentially wiping your database clean or extracting sensitive user information. That means they could wreak havoc on your gaming community, leading to a catastrophic loss of player trust and data integrity.
Think of it like a party invitation with a hidden clause that lets party crashers sneak in unnoticed — attackers can manipulate the `WorldName` parameter and gain unauthorized access to your database! This SQL Injection vulnerability allows attackers to manipulate the `WorldName` parameter in requests sent to the PartyBooking component, leading to the execution of malicious SQL commands on the database without proper authorization.
If exploited, this vulnerability could allow attackers to execute arbitrary SQL commands, potentially wiping your database clean or extracting sensitive user information. That means they could wreak havoc on your gaming community, leading to a catastrophic loss of player trust and data integrity. Upgrade your rAthena server to the latest commit (0d89ae0) immediately to patch this vulnerability. Additionally, conduct a thorough review of your SQL queries to ensure they use prepared statements to prevent similar issues in the future. You've got this! By taking these steps, you'll safeguard your server and keep your players happy! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| rathena/rathena | < 2025-09-06 | 2025-09-06 |