CyberRota Analysis
AI-GeneratedShlink is vulnerable to a blind SQL injection that permits authenticated API key holders to inject arbitrary SQL fragments via an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. This flaw could allow attackers to extract sensitive data, including URLs, visitor records, and hashed API keys, through various SQL injection techniques. Organizations using Shlink should prioritize addressing this vulnerability to protect their data integrity and user privacy.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets from any tenant.