Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Tautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters
Vulnerability Description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.17.0 for parameters "before" and "after" and from version 2.1.0-beta to before version 2.17.0 for parameters "section_id" and "user_id", the /api/v2?cmd=get_home_stats endpoint passes the section_id, user_id, before, and after query parameters directly into SQL via Python %-string formatting without parameterization. An attacker who holds the Tautulli admin API key can inject arbitrary SQL and exfiltrate any value from the Tautulli SQLite database via boolean-blind inference. This issue has been patched in version 2.17.0.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Vulnerability Title
Tautulli SQL注入漏洞
Vulnerability Description
Tautulli是Tautulli开源的一款用于监控Plex Media Server（媒体服务器）的应用程序。 Tautulli 2.14.2至2.17.0之前版本存在SQL注入漏洞，该漏洞源于/api/v2?cmd=get_home_stats端点未对参数进行参数化处理，可能导致SQL注入攻击。
CVSS Information
N/A
Vulnerability Type
N/A