Description
HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted include_info values to the /api/locations/list endpoint. Attackers can place subqueries in include_info, which PlantsModel::getSpecificInfo() concatenates into the column list, to read any database table including user password hashes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| danielbrendel | hortusfox-web | < 6.2 | 6.2 |
References
- Patch Commit patch
- https://github.com/danielbrendel/hortusfox-web product
- GitHub Security Advisory (GHSA-4w8p-x2jj-42w7) vendor-advisory
- https://github.com/danielbrendel/hortusfox-web/blob/v6.1/app/models/PlantsModel.php#L1026-L1033 technical-description
- https://github.com/danielbrendel/hortusfox-web/blob/v6.1/app/controller/api.php#L642-L650 technical-description
- VulnCheck Advisory: HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter third-party-advisory