BOS IPCs SQL Injection Vulnerability in Firmware 21.45.8.2.2_220219

A SQL injection vulnerability has been identified in BOS IPCs running firmware 21.45.8.2.2_220219, prior to 21.45.8.2.3_230220. This vulnerability allows remote attackers to access sensitive database information by sending crafted input in the request body. The issue arises from the application's request body processing, which improperly handles user input, enabling attackers to manipulate SQL queries and extract data from the database.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to interfere with database queries. This could lead to unauthorized data access, modification of application data, disruption of application logic, privilege escalation within the database, or control over the database server.

Remediation

Users are advised to update the firmware of the affected cameras to version 21.45.8.2.3_230220.