Authenticated SQL Injection in Ticketing REST API

Executive Summary

This is a high-severity SQL injection vulnerability in Tenable Security Center versions 6.6.0, 6.7.2, and 6.8.0. An authenticated non-admin user can exploit it via the ticketing REST API to run arbitrary SQL commands, potentially accessing, modifying, or deleting sensitive data in the appliance database.

Useful 0 Not Useful 0

Detection Guidance

To detect this SQL injection vulnerability, monitor network traffic for unusual SQL queries targeting the ticketing REST API. Check for repeated failed login attempts or unexpected database access patterns. Use tools like SQLMap to test for injection points in the API endpoints. Review logs for suspicious queries or errors indicating SQL syntax issues.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal sensitive data, alter or delete database records, or gain unauthorized access to system functions. The high CVSS score (9.6) indicates significant risk, especially since exploitation requires only low-privilege authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Apply Security Center Patch SC202607.1 immediately to address the vulnerability. Ensure all third-party components like PostgreSQL, Apache, OpenSSL, PHP, and Redis are updated to their latest versions. Restrict non-admin user access to the minimum required privileges. Monitor database activity for unauthorized queries or data access attempts.

Useful 0 Not Useful 0