Mautic SQL Injection Vulnerability in Contact Activity API Sorting

A SQL injection vulnerability has been identified in Mautic's API endpoint for retrieving contact activities. This issue arises because the parameter that determines the sort direction was not properly validated against an allowlist. As a result, authenticated users could potentially inject arbitrary SQL commands through the API. This vulnerability affects Mautic versions 2.10.0 and later.

Impact

Exploitation of this vulnerability allows for SQL injection, where an authenticated user can manipulate SQL queries to execute arbitrary SQL commands. This could lead to unauthorized data access or modification.

Remediation

Users are advised to update to Mautic versions 4.4.19, 5.2.10, 6.0.8, 7.0.1 or later.