CyberRota Analysis
AI-GeneratedAuthenticated moderators in BigBlueButton versions prior to 3.0.23 are vulnerable to SQL injection through the meetingId and userId parameters, potentially allowing attackers to execute arbitrary SQL commands on the application database. The impact of this vulnerability is significant, as it could lead to unauthorized data access or manipulation. Organizations using affected versions should prioritize upgrading to 3.0.23 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala. The method interpolated those values into breakout room visibility queries, allowing arbitrary SQL execution against the application database. This issue is fixed in version 3.0.23.