Shinobi
Monthly
Unauthenticated arbitrary database query execution in the Shinobi open-source video management/NVR platform (versions prior to commit 5a76c74f) lets attackers who can reach the child node service run SQL against the backend. By presenting a hardcoded connection key during the child-node WebSocket handshake, an attacker bypasses authentication and dispatches queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated arbitrary database query execution in the Shinobi open-source video management/NVR platform (versions prior to commit 5a76c74f) lets attackers who can reach the child node service run SQL against the backend. By presenting a hardcoded connection key during the child-node WebSocket handshake, an attacker bypasses authentication and dispatches queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.