CyberRota Analysis
AI-GeneratedMautic's getLeadIdsByFieldValueAction is vulnerable due to insufficient sanitization of user input, allowing an attacker to inject SQL through the field name parameter, which is directly concatenated into a SQL query without proper validation. This vulnerability can lead to unauthorized data access or manipulation, posing a significant risk to the integrity of the database. Organizations using Mautic should prioritize addressing this issue, especially those with authenticated user access, to prevent potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue where it is concatenated directly as a raw SQL column identifier ( = 'l.'.) rather than being validated against a whitelist of real column names or passed as a bound parameter.