Quiter Gateway SQL Injection Vulnerability

A SQL injection vulnerability exists in Quiter Gateway versions prior to 4.7.0. This vulnerability allows attackers to retrieve, create, update, and delete databases by exploiting the 'suceso.contenido' parameter in the '/QMSCliente/Sucesos.action' endpoint.

Impact

Exploitation of this vulnerability allows for unauthorized database manipulation, including retrieval, creation, updating, and deletion of database records.

Remediation

Quiter has released a patch in version 4.7.0 of Quiter Gateway, which is available to all affected customers. Instructions for updating to this version can be found on the Quiter website.