Threats tagged 'ghsa-5fjw-vh88-cccm'

A SQL Injection vulnerability exists in the /BEIMSWeb/contractor.asp endpoint of BEIMS Contractor Web version 5.7.139, a legacy product no longer maintained or patched by the vendor. This flaw allows an unauthorised attacker to execute arbitrary SQL commands by exploiting unsanitized input parameters, potentially compromising the confidentiality, integrity, and availability of the underlying database. The vulnerability requires the affected endpoint to be accessible over the internet. Other versions have not been confirmed but should be assumed vulnerable until vendor guidance is available.