SonicWall addresses SQLi vulnerability in Analytics & GMS products

On Friday, network security provider SonicWall released patches to prevent a serious SQL injection (SQLi) flaw impacting its Analytics On-Prem and Global Management System (GMS) products.

The CVE-2022-22280 vulnerability has a CVSS severity system of 9.4 and stems from what the company describes as "incorrect neutralization of special elements" in a SQL command, which could lead to an unauthenticated SQL injection.

If the resulting SQL query does not sufficiently remove or quote SQL syntax from user-controllable inputs, MITRE states in its definition of SQL injection that certain inputs may be read as SQL instead than ordinary user data.

This can be used to change query logic to circumvent security checks or to include extra statements that impact the back-end database, perhaps including the execution of system instructions.

H4lo and Catalpa of DBappSecurity HAT Lab are credited with identifying and reporting the vulnerabilities affecting Analytics On-Prem versions 2.5.0.3-2520 and earlier and GMS versions previous to and including 9.3.1-SP2-Hotfix1.

Organizations utilizing susceptible appliances should upgrade to Analytics 2.5.0.3-2520-Hotfix1 and GMS 9.3.1-SP2-Service Pack 2 (SP2).

SonicWall stated that there is no workaround available for this vulnerability. Incorporating a Web Application Firewall (WAF) to block SQLi attempts, however, can dramatically minimize the chance of exploitation.

SonicWall addresses SQLi vulnerability in Analytics & GMS products

Related threat feeds

FIFA World Cup Broadcast Infrastructure Exposed Through Broken Authorization Flaw

Splunk Enterprise Vulnerability Enables Unauthenticated Remote Code Execution

ServiceNow MID Server Authentication Bypass Exploited to Extract Data from 341 Customer Instances