GestSup SQL Injection Vulnerability in Asset List Functionality

A series of SQL injection vulnerabilities have been identified in GestSup versions up to and including 3.2.56. These vulnerabilities reside within the asset list feature, where several request parameters used for filtering, searching, or sorting assets are directly included in SQL queries without adequate sanitization. This oversight enables authenticated attackers to manipulate database queries, potentially leading to unauthorized access to or modification of database contents, depending on their database privileges.

Impact

Exploitation of these vulnerabilities allows for SQL injection, which could lead to unauthorized access to or modification of database contents.