Digiwin SFT SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Digiwin's SFT product, specifically in versions through 3.7.12. This vulnerability allows unauthenticated remote attackers to inject arbitrary SQL commands, potentially leading to unauthorized access, modification, or deletion of database contents.

Impact

Exploitation of this vulnerability allows for arbitrary SQL injection, enabling attackers to read, modify, or delete database information.

Remediation

Users are advised to update to version 3.7.4.5 or later and install patch KB202505001. For those unable to apply the update immediately, it is recommended to restrict access to the SFT website from external networks or limit access for specific internal users.