CVE-2019-15016 SQL injection in Palo Alto Networks Zingbox Inspector
An authenticated user can exploit unsanitized input in the Zingbox Inspector management interface to perform SQL injection attacks against the database.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15016?
CVE-2019-15016 is a high-severity SQL injection vulnerability in Palo Alto Networks Zingbox Inspector, published on 9 Oct 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitized data provided by an authenticated user to be passed from the web UI into the database.
Weakness: CWE-89
Which versions are affected by CVE-2019-15016?
It affects 1 product.
Products include Zingbox Inspector.
How do I fix CVE-2019-15016?
No fix has been published for CVE-2019-15016 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2019-15016 being exploited?
There is no known exploitation of CVE-2019-15016 in the wild and no public exploit code.
Other vulnerabilities in Palo Alto Networks Zingbox Inspector
- CVE-2019-15019 Other in Palo Alto Networks Zingbox Inspector
- CVE-2019-15020 Command injection in Palo Alto Networks Zingbox Inspector
- CVE-2019-1584 Command injection in Palo Alto Networks Zingbox Inspector
- CVE-2019-15014 Command injection in Palo Alto Networks Zingbox Inspector
- CVE-2019-15015 Hardcoded credentials in Palo Alto Networks Zingbox Inspector
Sources
Also known as GHSA-fh6x-ww24-xf7w.