Synnefo Internet Management Software SQL Injection Vulnerability Allowing Unauthorized Database Access and OS Command Execution

A SQL injection vulnerability has been identified in Synnefo Internet Management Software (IMS) versions through 2023. The issue arises from inadequate input validation in a specific API endpoint, which allows attackers to manipulate SQL queries by sending crafted input. Exploitation of this vulnerability could result in unauthorized access to database records with administrative privileges, potentially leading to further privilege escalation and the execution of arbitrary operating system commands.

Impact

Exploitation of this vulnerability could allow an attacker to access sensitive database records with administrative rights, escalate privileges, and execute arbitrary commands on the operating system.