Iomad SQL Injection Vulnerability in Company Admin Block

A critical SQL injection vulnerability has been identified in Iomad versions up to 5.0, specifically within the Company Admin Block component. This vulnerability allows for remote exploitation and requires company admin permissions to access the affected functionality. The issue has been confirmed on the IOMAD_405_STABLE branch.

Impact

Exploitation of this vulnerability leads to a full database compromise, affecting all tenants.

Remediation

Patches for this vulnerability have been applied to the Iomad 4.5 and 5.0 branches. Users on older, unsupported versions should upgrade to a version that includes the patch.