Red Hat Satellite Katello Plugin SQL Injection Vulnerability Allowing Denial-of-Service

A vulnerability in the Katello plugin for Red Hat Satellite allows remote attackers to inject arbitrary SQL commands via the sort_by parameter of the /api/hosts/bootc_images API endpoint. This flaw arises from inadequate input sanitization, potentially leading to database errors that cause a denial-of-service condition. Additionally, it could enable Boolean-based blind SQL injection, allowing attackers to extract sensitive information from the database.

Impact

Exploitation of this vulnerability could cause a denial-of-service condition by triggering database errors. Furthermore, the vulnerability could be exploited to perform Boolean-based blind SQL injection, potentially allowing attackers to extract sensitive information from the database.