CVE-2026-44381 Scanner
CVE-2026-44381 Scanner - SQL Injection vulnerability in MISP
Short Info
Level
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
19 days 23 hours
Scan only one
Domain, Subdomain, IPv4
Toolbox
The Malware Information Sharing Platform, also known as MISP, is widely used by security researchers and organizations for sharing structured threat information. It's primarily deployed in environments where threat intelligence sharing is crucial for cyber defense strategies. Developed with the intent of improving defense mechanisms, MISP supports the analysis and sharing of several threat indicators. Used by governmental, corporate, and research institutions worldwide, it aims to facilitate real-time intelligence sharing on malware and cyber threats. The platform is appreciated for its open-source nature and its widespread adoption across various cybersecurity domains.
SQL Injection is a critical vulnerability that allows attackers to interfere with operations of a database by injecting arbitrary SQL queries. In MISP, this vulnerability exists in the EventsController where the order parameter is not adequately sanitized before being used in SQL queries. Attackers can exploit this flaw to manipulate database queries, potentially leading to unauthorized data access or corruption. This vulnerability is particularly dangerous because it can be executed remotely without authentication, increasing the ease of exploitation by malicious actors.
The vulnerability is found in the order parameter of the POST request to the /events/index endpoint. When a malicious payload is sent to this endpoint, the absence of input validation allows for the execution of arbitrary SQL queries. The primary vector for this attack is using an authenticated user's authorization key to perform the exploitation. Failure to properly sanitize this parameter can result in unauthorized SQL command execution, allowing attackers to read or modify the database directly.
If exploited, this vulnerability could allow attackers to execute arbitrary SQL commands, potentially leading to data breaches, unauthorized data manipulation, or complete database compromise. This could mean exposure of sensitive threat intelligence, unauthorized changes to MISP data entries, or even deletion of crucial data. Such acts could severely disrupt operations for any entity relying on MISP for threat intelligence management.
REFERENCES
