Threats tagged 'ghsa-f9rp-5h65-7c68'

A SQL injection vulnerability exists in the ReportService.queryBiData function of erupts erupt versions up to 2.3.0. This vulnerability allows remote attackers with low privileges to manipulate the 'sort' argument to execute unauthorized SQL commands. The issue is fixed in version 2.4.0. Exploit code is publicly available, and the vulnerability has a medium severity rating.