CyberRota Analysis
AI-GeneratedManticore Search versions prior to 28.4.4 are vulnerable due to insufficient permission validation in multi-statement SQL requests, enabling read-only users to execute unauthorized queries. This flaw allows attackers to append additional SELECT statements, potentially exposing sensitive credential tables and password hashes, which could facilitate unauthorized administrative access. Organizations using affected versions should prioritize patching to mitigate the risk of credential exposure and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery.