If an attacker could convince a victim to load the Archery website via the vulnerable URL, they could exploit this vulnerability to execute arbitrary SQL queries, resulting in the compromise of the user’s session. In order to exploit this issue, an attacker would need to trick a victim into visiting the Archery website via a malicious URL.
Archery v1.8.5 to v1.9.3 was also discovered to be susceptible to a Cross-Site Request Forgery (CSRF) vulnerability via the load_config interface.
If an attacker could convince a victim to access the Archery website via a specially crafted URL, they could exploit this issue to force the victim’s browser to make requests to other arbitrary websites. In order to exploit this issue, an attacker would need to trick a victim into accessing the Archery website via a malicious URL.
Archery v1.9.3 to v1.9.6 was discovered to be vulnerable to a SQL injection issue via the ThreadIDs parameter in the kill_session interface.
If an attacker were able to exploit one of the aforementioned issues, they could leverage it to execute arbitrary SQL queries, resulting in the compromise of the user’s session. In order to exploit this issue, an attacker would need to trick a victim into visiting the Archery website via a malicious URL.
Archery v1.10.0 to v1.11.3
Archery v1.10.0 to v1.11.3 was discovered to be vulnerable to a SQL injection issue via the ThreadIDs parameter in the kill_session interface.
If an attacker were able to exploit one of the aforementioned issues, they could leverage it to execute arbitrary SQL queries, resulting in the compromise of the user’s session. In order to exploit this issue, an attacker would need to trick a victim into visiting the Archery website via a malicious URL.
Archery – Stealth Attacks and CSRF Protection
A stealth attack is any type of attack that can only occur after a user has taken an action of some kind. This could be visiting the website, or even just opening a malicious email. In this case, the Archery application is susceptible to non-perceived attacks that could allow attackers to access valuable information from the database in order to steal user account credentials.
The CSRF protection feature within Archery protects against these types of attacks and prevents unauthorized actions from occurring on a user’s behalf.
Timeline
Published on: 09/13/2022 15:15:00 UTC
Last modified on: 09/14/2022 22:25:00 UTC