Security News > 2023 > June > Critical SQL Injection Flaws Expose Gentoo Soko to Remote Code Execution

Multiple SQL injection vulnerabilities have been disclosed in Gentoo Soko that could lead to remote code execution on vulnerable systems.

"These SQL injections happened despite the use of an Object-Relational Mapping library and prepared statements," SonarSource researcher Thomas Chauchefoin said, adding they could result in RCE on Soko because of a "Misconfiguration of the database."

They were addressed within 24 hours of responsible disclosure on March 17, 2023.

Gentoo.org, offering users an easy way to search through different Portage packages that are available for Gentoo Linux distribution.

"The SQL injections were exploitable and had the ability to disclose the PostgreSQL server's version and execute arbitrary commands on the system," SonarSource said.

Earlier this year, security weaknesses were also disclosed in open-source software such as Pretalx and OpenEMR that could pave the way for remote attackers to execute arbitrary code.

News URL

https://thehackernews.com/2023/06/critical-sql-injection-flaws-expose.html