Uniguest Tripleplay SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Uniguest Tripleplay versions 23.1 and later. This vulnerability allows remote attackers to execute arbitrary SQL queries on the backend database. The issue arises from a lack of proper authentication, enabling unauthorized users to manipulate database queries and potentially access or modify sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the backend database, allowing attackers to execute arbitrary SQL queries. This could result in data leakage, unauthorized data modification, or in some cases, executing commands on the server if the database is connected to the application server in a vulnerable way.