Progress MOVEit Transfer SQL Injection

Summary#

Invicti identified a Possible SQL Injection. Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), is vulnerable to an SQL injection vulnerability that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements.

Impact#

The vulnerability has been exploited to upload a web shell onto the MOVEit Transfer server.

Remediation#

Patches for all supported MOVEit Transfer versions are available.

Classifications#

WASC-19, ISO27001-A.14.2.5, HIPAA-164.306(a), 164.308(a), PCI v3.2-6.5.1, OWASP 2013-A1, OWASP 2017-A1, CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, CAPEC-66, CWE-89

Progress MOVEit Transfer SQL Injection

Related Articles

Build your resistance to threats. And save hundreds of hours each month.