Threats tagged 'ghsa-92hp-j24w-3jvw'

A SQL Injection vulnerability exists in Apache OFBiz 24.09 before 24.09.08 affecting MySQL/MariaDB-backed deployments. It allows remote unauthenticated attackers to disclose arbitrary rows by exploiting the entity engine's generic performFind service with crafted ignore-case find requests. The issue arises because input values are inlined into SQL queries without proper parameter binding, enabling injection via backslash escapes specific to MySQL/MariaDB. The vulnerability does not affect Derby or PostgreSQL datasources. Upgrading to version 24.09.08 resolves the issue.