cbcvebase.
CVE-2018-20469
published 2019-06-17

CVE-2018-20469: An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to h2 SQL injection. This can be…

PriorityP273critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
18.54%
96.9th percentile
An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to h2 SQL injection. This can be exploited to inject SQL queries and run standard h2 system functions.

Affected

1 ranges
VendorProductVersion rangeFixed in
sahiprosahi_pro<= 8.0.0—

Detection & IOCsextracted from sources · hover to see the quote

url/_s_/dyn/pro/DBReports?sql=SELECT DISTINCT memory_used() AS ROWSTATUS, SCRIPTREPORTS.SCRIPTREPORTID,SCRIPTREPORTS.SCRIPTNAME,SUITEREPORTS.* FROM SUITEREPORTS,SCRIPTREPORTS↗
path/_s_/dyn/pro/DBReports↗
  • →Monitor HTTP requests to the /_s_/dyn/pro/DBReports endpoint for the presence of a 'sql' query parameter, which is the vulnerable injection point in the Sahi Pro web reports module. ↗
  • →Detect exploitation attempts by inspecting the 'sql' parameter for H2-specific system functions such as memory_used(), which are indicative of SQL injection probing or exploitation. ↗
  • →Flag requests containing H2 SQL keywords (e.g., SUITEREPORTS, SCRIPTREPORTS, SCRIPTREPORTID) in the 'sql' parameter of the DBReports endpoint as potential exploitation of CVE-2018-20469. ↗
  • ·The vulnerability affects Tyto Sahi Pro through version 7.x.x and 8.0.0; detections should be scoped to environments running these versions. ↗
  • ·The injection leverages H2 database system functions specifically; generic SQL injection signatures may miss H2-specific payloads like memory_used(). ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.