Description
OSNexus QuantaStor SDS Manager is vulnerable to SQL injection in the login endpoint. The username field is not properly sanitized before being incorporated into a SQL query, allowing an unauthenticated remote attacker to bypass authentication and log in as an administrator without supplying a valid password.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Osnexus | QuantaStor | 5.9 – < 6.6.1 | 6.6.1 |