CVE-2022-26348 SQL injection in Command Centre

What is CVE-2022-26348?

CVE-2022-26348 is a high-severity SQL injection vulnerability in Gallagher Command Centre, published on 6 Jul 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server. The Windows Registry setting allows an attacker using the Visitor Management Kiosk, an application designed for public use, to invoke an arbitrary SQL query that has been preloaded into the registry of the Windows Server to obtain sensitive information. This issue affects: Gallagher Command Centre 8.60 versions prior to 8.60.1652; 8.50 versions prior to 8.50.2245; 8.40 versions prior to 8.40.2216; 8.30 versions prior to 8.30.1470; version 8.20 and prior versions.

Weakness: CWE-89

Which versions are affected by CVE-2022-26348?

It affects 1 product.

Products include Gallagher Command Centre.

How do I fix CVE-2022-26348?

No fix has been published for CVE-2022-26348 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-26348 being exploited?

There is no known exploitation of CVE-2022-26348 in the wild and no public exploit code.

Other vulnerabilities in Gallagher Command Centre

• CVE-2021-23140 Missing authorization in Command Centre Critical 9.9
• CVE-2021-23230 SQL injection in Command Centre Critical 9.9
• CVE-2020-16096 Missing authorization in Command Centre Critical 9.9
• CVE-2020-16098 Information disclosure in Command Centre Critical 9.8
• CVE-2019-15294 Information disclosure in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-ff2w-r9pm-qh5j.