Apache VCL SQL Injection Vulnerability in Block Allocation Form

A SQL injection vulnerability has been identified in Apache VCL versions 2.2 through 2.5.1. This vulnerability allows users to manipulate form data when requesting a new Block Allocation, potentially altering a SELECT SQL statement. However, the data returned by the SELECT statement is not accessible to the attacker.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries and potentially access or modify database information.

Remediation

Users are advised to upgrade to Apache VCL version 2.5.2, which addresses this vulnerability.