Helicalinsight
Monthly
SQL injection in Helical Insight through 7.0.0 allows authenticated users with at least viewer privileges to execute arbitrary SQL queries via crafted Numeric or String placeholder values sent to the /executeDatasource endpoint, bypassing the broken SqlDetect guard. This enables reading unexposed database tables and modifying data within the report's configured data source, with impact limited by the privileges of the database account used by the application. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated file disclosure in Helical Insight through 7.0.0 lets a user with viewer-level privileges read files outside the solution directory through the path parameter of /getExternalResource, bypassing per-resource access control by supplying parent-directory segments. Exploitation requires a valid low-privilege session and is constrained to files carrying an allowed extension (js, json, html), so confidentiality impact is limited and there is no integrity or availability effect - matching the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N and the assigned score of 5.3. No public exploit code was identified at time of analysis, the CVE is not listed in CISA KEV, and no EPSS probability was supplied; this is a medium-severity information-disclosure issue rather than an urgent priority.
SQL injection in Helical Insight through 7.0.0 allows authenticated users with at least viewer privileges to execute arbitrary SQL queries via crafted Numeric or String placeholder values sent to the /executeDatasource endpoint, bypassing the broken SqlDetect guard. This enables reading unexposed database tables and modifying data within the report's configured data source, with impact limited by the privileges of the database account used by the application. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated file disclosure in Helical Insight through 7.0.0 lets a user with viewer-level privileges read files outside the solution directory through the path parameter of /getExternalResource, bypassing per-resource access control by supplying parent-directory segments. Exploitation requires a valid low-privilege session and is constrained to files carrying an allowed extension (js, json, html), so confidentiality impact is limited and there is no integrity or availability effect - matching the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N and the assigned score of 5.3. No public exploit code was identified at time of analysis, the CVE is not listed in CISA KEV, and no EPSS probability was supplied; this is a medium-severity information-disclosure issue rather than an urgent priority.