title: SQL injection in SUSE studio via select parameter
description: A vulnerability in the listing of available software of SUSE Studio Onsite, SUSE Studio Onsite 1.1 Appliance allows authenticated users to execute arbitrary SQL statements via SQL injection. Affected releases are SUSE Studio Onsite: versions prior to 1.0.3-0.18.1, SUSE Studio Onsite 1.1 Appliance: versions prior to 1.1.2-0.25.1.
problem types: CWE-89
affected:
{
product: SUSE Studio Onsite
vendor: SUSE
versions:
lessThan: 1.0.3-0.18.1, status: affected, version: unspecified, versionType: custom
}
{
product: SUSE Studio Onsite 1.1 Appliance
vendor: SUSE
versions:
lessThan: 1.1.2-0.25.1, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.0
]