| Package | Affected versions | Patched versions |
|---|---|---|
| cachethq/cachet | ≤ 2.3.18 | |
| cachet | < 2.3.18 | 2.3.18 |
In Cachet versions through 2.3.18, there is a SQL injection which is in the SearchableTrait#scopeSearch(). Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session.
The original repository of https://github.com/CachetHQ/Cachet is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.
Update to version 2.5 or later in the https://github.com/fiveai/Cachet fork to fix this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free