CVE-2023-26443

Description

Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerability. We now properly encode single quotes for SQL FULLTEXT queries. No publicly available exploits are known.

Weakness classification

• security@open-xchange.com: CWE-89
• nvd@nist.gov: CWE-89

Primary references

• security@open-xchange.com — Third Party Advisory, VDB Entry
• security@open-xchange.com — Mailing List, Third Party Advisory
• security@open-xchange.com
• security@open-xchange.com — Release Notes
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes