CVE-2026-4317
CRITICAL
9,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
SQL inyection (SQLi) vulnerability in Umami Software web application through an improperly sanitized parameter, which could allow an authenticated attacker to execute arbitrary SQL commands in the database.Specifically, they could manipulate the value of the 'timezone' request parameter by including malicious characters and SQL payload. The application would interpolate these values directly into the SQL query without first performing proper filtering or sanitization (e.g., using functions such as 'prisma.rawQuery', 'prisma.$queryRawUnsafe' or raw queries with 'ClickHouse'). The successful explotation of this vulnerability could allow an authenticated attacker to compromiso the data of the database and execute dangerous functions.
89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
StableCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Authentication
Access Control
Potential Impacts:
Execute Unauthorized Code Or Commands
Read Application Data
Gain Privileges Or Assume Identity
Bypass Protection Mechanism
Modify Application Data
Applicable Platforms
Languages:
Not Language-Specific, SQL
Technologies:
Database Server
https://www.incibe.es/en/incibe-cert/notices/aviso/sql-inyection-umami-software…