CyberRota Analysis
AI-GeneratedThe vulnerability affects Wazuh versions 4.6.0 through 4.14.6 and 5.0.0-beta3 on Windows systems, where local users can exploit insufficient input validation in file path handling to inject SQL commands. This could lead to unauthorized manipulation of data returned by the File Integrity Monitoring (FIM) system, potentially compromising the integrity of monitored files. Organizations using affected Wazuh versions should prioritize upgrading to the patched versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile() and DB::searchFile() in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems, FIMDBCreator::encodeString() does not escape the value. A local user who can create a filename in a File Integrity Monitoring directory can inject a UNION SELECT expression when wazuh-syscheckd processes or deletes that path. The confirmed primitive manipulates SELECT result sets consumed by the FIM code; stacked statements and remote code execution were not demonstrated. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.
Related CVEs
Other vulnerabilities affecting the same vendor(s)