Executive brief
Serendipity, a popular open-source weblog engine, contains a security vulnerability that could allow an authorized user to interfere with the underlying database. By exploiting this flaw, an attacker with a valid account could potentially view, modify, or delete sensitive information stored in the system's database. This could lead to unauthorized data access or a complete disruption of the blogging service.
Technical details
A SQL injection vulnerability exists in Serendipity version 2.0.5 within the 'include/functions_entries.inc.php' component. The flaw is caused by a failure to properly cast or sanitize the 'cat' parameter (representing categories) to an integer before using it in a database query. A remote attacker with authenticated access can exploit this by submitting specially crafted SQL commands through the affected parameter. Successful exploitation allows for arbitrary SQL execution, which can lead to full database compromise, including data exfiltration or modification. The issue was addressed in version 2.1-rc1 by implementing proper integer casting for category insertions.
Affected products
- s9y Serendipity 2.0.5
Timeline
- 2017-01-26: patched: Fix released in version 2.1-rc1
- 2017-01-28: disclosed: NVD publication date