ESAFENET CDG SQL Injection Vulnerability in getFileTypeList.jsp Endpoint

A critical SQL injection vulnerability has been identified in ESAFENET CDG version 5.6.3.154.205. The issue resides in the getFileTypeList.jsp file, where the typename parameter can be manipulated to execute arbitrary SQL commands. This vulnerability can be exploited remotely, potentially allowing an attacker to gain full control over the underlying MSSQL server.

Impact

Exploitation of this vulnerability allows for SQL injection, which could lead to unauthorized data access, data manipulation, or execution of arbitrary commands on the database server. In this case, it has been reported that the vulnerability could be exploited to execute arbitrary code on the MSSQL server, potentially allowing full control over the server.