VMWare has announced a critical SQL Injection flaw affecting users of its HCX enterprise.
See also: Broadcom patches critical vulnerability in VMware vCenter Server
The vulnerability, labeled CVE-2024-38814, carries a CVSS severity rating of 8.8/10 and allows attackers with non-administrative privileges to execute remote code on the HCX manager.
“A malicious user authentication with non-administrator privileges can inject specially crafted SQL queries and perform unauthorized remote code execution on the HCX manager,” according to an advisory from the virtualization technology vendor.
VMware HCX, where SQL Injection was discovered, is an application portability platform designed to simplify application migration, workload balancing, and business continuity across data centers and clouds.
See also: VMware Fusion vulnerability allows malicious code execution
The Broadcom-owned company said the SQL Injection flaw affects multiple versions of the VMware HCX platform, including versions 4.8.x, 4.9.x , and 4.10.x.
VMware has published instructions for applying the available patches. The company credits Sina Kheirkhah of SinSinology for reporting the bug through the ZDI bug bounty program.
See also: SQL injection bypasses airport security checks
A SQL Injection vulnerability, such as the one in VMware HCX, is one of the most common and dangerous attacks in the field of network and application security. This type of attack exploits weaknesses in databases, where the attacker injects malicious SQL code into queries executed on the database. If the application does not have appropriate controls and the data has not been properly sanitized, it can allow the attacker to access, delete or modify data in the database, or even take complete control of the system. The consequences of such a vulnerability can be devastating, making protection against SQL Injection critical to the security of any application.
Source: securityweek
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
