TeamPass SQL Injection Vulnerability in users.queries.php
Summary
CVE-2017-9436: TeamPass SQL injection in users.queries.php. Affects nilsteampassnet/teampass versions < 2.1.27.5. Fixed in 2.1.27.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TeamPass is a password management system that allows teams to securely store and share passwords. It is commonly used by organizations to centralize password management and improve security. The vulnerability in question affects the users.queries.php file in TeamPass versions prior to 2.1.27.5.
Vulnerability Detail
The vulnerability is a SQL injection in the users.queries.php file of TeamPass. This allows an attacker to manipulate SQL queries and potentially gain unauthorized access to the database. The impact of this vulnerability can be severe, as it can lead to unauthorized access to sensitive information, data leakage, and potential compromise of the entire TeamPass system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
2.1.27.5
This is the first release that contains the fix.
composer require nilsteampassnet/teampass:2.1.27.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of TeamPass.
Conclusion
The SQL injection vulnerability in the users.queries.php file of TeamPass versions prior to 2.1.27.5 can lead to unauthorized access to the database and compromise of the entire system. It is crucial to upgrade to the latest version of TeamPass to patch this vulnerability and ensure the security of your password management system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nilsteampassnet/teampass →
FAQ
The vulnerability allows an attacker to perform SQL injection and potentially gain unauthorized access to the TeamPass database. This can lead to data leakage, unauthorized access to sensitive information, and compromise of the entire TeamPass system.
You can use the Vulert Playground at Vulert Scanner to check if your version of TeamPass is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will alert you if your application is vulnerable.
Yes, a fix is available for this vulnerability. It is recommended to upgrade to TeamPass version 2.1.27.5 or later to patch the SQL injection vulnerability.
No, there are no known workarounds for this vulnerability. It is crucial to apply the recommended fix by upgrading to the latest version of TeamPass.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-cm26-gp8j-w6xf/GHSA-cm26-gp8j-w6xf.json
References
Related vulnerabilities
Recent vulnerabilities recorded for nilsteampassnet/teampass.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
