SQL Injection in Nessus Scan Result Import

Executive Summary

This vulnerability is a SQL injection issue in Nessus. It allows an attacker to create a malicious scan result file that, when imported by a privileged user, injects harmful SQL commands into the scan results database.

This injection can lead to unauthorized actions on the database, such as extracting sensitive scan-result data.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by enabling an attacker to exfiltrate sensitive scan-result data from the Nessus database.

Since the attack requires a privileged user to import the malicious file, it could lead to unauthorized data disclosure and compromise of scan results.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to inject malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data when a privileged user imports a crafted scan result file.

Such unauthorized data exfiltration could impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive information and preventing unauthorized access or disclosure.

However, the provided information does not explicitly describe the direct effects on compliance with these standards.

Useful 0 Not Useful 0