Executive brief
ResourceSpace is an open-source digital asset management (DAM) platform used by organizations to organize and share media files. A security flaw in version 8.6 allows unauthorized individuals to access the underlying database without a password. This could lead to the theft of sensitive information, including user credentials and private asset metadata, potentially compromising the entire system.
Technical details
A SQL injection vulnerability exists in ResourceSpace version 8.6 and earlier within the 'watched_searches.php' endpoint. The application fails to properly sanitize the 'ref' GET parameter before using it in a database query. An unauthenticated remote attacker can exploit this by sending specially crafted GET requests to the vulnerable endpoint. Successful exploitation allows for arbitrary SQL execution, enabling the attacker to extract sensitive data from the MySQL database, such as user tables and credentials. Public exploit code (PoC) using tools like sqlmap has been disclosed.
Affected products
- Montala ResourceSpace 8.6 and earlier
Timeline
- 2019-02-01: disclosed: Initial discovery and proof of concept by researcher dd_
- 2019-02-04: other: Exploit published to Exploit-DB
- 2026-04-05: advisory: CVE-2019-25662 published