Mura SQL Injection Vulnerability in beanFeed.cfc Allowing Query Manipulation

A SQL injection vulnerability has been identified in Mura versions prior to 10.1.14, specifically within the beanFeed.cfc component. This issue allows for injection of malicious SQL through the 'sortby' parameter of the 'getQuery' function, potentially leading to unauthorized data manipulation or disclosure.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries. This could lead to unauthorized data access, data modification, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a request to the 'beanFeed.cfc' component's 'getQuery' function. Include a crafted 'sortby' parameter that injects malicious SQL. The injection can be verified by observing unexpected database behavior, such as unauthorized data access or manipulation.

Remediation

Users are advised to update to Mura version 10.1.14 or later, where this vulnerability has been addressed.