SQL Injection in Nessus Scanner

Executive Summary

This vulnerability is a SQL injection issue in Nessus, a vulnerability scanning tool. It allows a remote, unauthenticated attacker who can control the reverse DNS records of a scanned host to inject malicious SQL commands into the scan results database.

By exploiting this, the attacker can manipulate the database that stores scan results, potentially leading to unauthorized access or modification of that data.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a remote, unauthenticated attacker to inject malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.

Such unauthorized data exfiltration could impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding sensitive information and preventing unauthorized access or disclosure.

However, there is no explicit information provided about the direct impact of this vulnerability on compliance with these standards.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is the potential exfiltration of scan-result data from the Nessus database.

Since the attacker can inject SQL commands remotely without authentication, they might access sensitive information contained in the scan results, which could include details about vulnerabilities and configurations of scanned hosts.

Useful 0 Not Useful 0