Executive brief
ResourceSpace, an open-source digital asset management system, contains a security flaw that allows authorized users to run unauthorized database commands. By submitting specially crafted requests, a user with basic account access could steal sensitive information, including user credentials and internal database structures. This could lead to a full compromise of the asset management system and the data it protects.
Technical details
An SQL injection vulnerability exists in ResourceSpace version 8.6 and prior within the 'collection_edit.php' component. The root cause is improper neutralization of special elements in the 'keywords' POST parameter. An authenticated attacker with network access to the application can submit crafted SQL payloads to extract sensitive information from the underlying MySQL database, including schema names and user credentials. The vulnerability can be exploited using boolean-based blind, error-based (EXTRACTVALUE), and time-based blind injection techniques. While the advisory mentions a related CSRF weakness (CWE-352), the primary impact is unauthorized data exfiltration via SQLi.
Affected products
- Montala ResourceSpace 8.6 and earlier
Timeline
- 2019-01-21: other: Vendor alerted
- 2019-01-25: disclosed: Exploit discovered/authored
- 2019-01-28: other: Exploit published to Exploit-DB
- 2026-04-12: advisory: CVE published/assigned