CVE-2024-30922

An attacker can inject malicious SQL code through the WHERE clause used during award document rendering. Improper validation or lack of adequate input data sanitization allows manipulation of database queries. Through a properly crafted query, it is possible to execute arbitrary code on the server.

An attacker can gain full access to the database (read, modify, delete data) and execute arbitrary code on the server, which may lead to complete system takeover.

Apply patches available from the vendor according to the references. It is also recommended to implement validation and sanitization of input data and consider using parameterized queries (prepared statements) as a temporary security measure.

DerbyNet v9.0