Manticore Search
Monthly
Multi-statement SQL authorization bypass in Manticore Search 27.0.0 through 28.4.3 lets an authenticated read-only user escalate to full administrative control: the server validates permissions only for the first statement in a batch, so appending additional SELECT statements exposes system credential tables and their password hashes, which can be replayed to authenticate as an administrator without cracking any plaintext. No user interaction is required, and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the only prerequisite is an existing low-privileged account with SQL access over the MySQL-protocol interface. This is a genuine, actionable priority rather than a high-CVSS-but-low-real-risk paper finding.
Multi-statement SQL authorization bypass in Manticore Search 27.0.0 through 28.4.3 lets an authenticated read-only user escalate to full administrative control: the server validates permissions only for the first statement in a batch, so appending additional SELECT statements exposes system credential tables and their password hashes, which can be replayed to authenticate as an administrator without cracking any plaintext. No user interaction is required, and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the only prerequisite is an existing low-privileged account with SQL access over the MySQL-protocol interface. This is a genuine, actionable priority rather than a high-CVSS-but-low-real-risk paper finding.