Shinobi
Monthly
Unauthenticated arbitrary database query execution in the Shinobi open-source video management/NVR platform (versions prior to commit 5a76c74f) lets attackers who can reach the child node service run SQL against the backend. By presenting a hardcoded connection key during the child-node WebSocket handshake, an attacker bypasses authentication and dispatches queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.
An issue was discovered in Shinobi through ocean version 1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.
Unauthenticated arbitrary database query execution in the Shinobi open-source video management/NVR platform (versions prior to commit 5a76c74f) lets attackers who can reach the child node service run SQL against the backend. By presenting a hardcoded connection key during the child-node WebSocket handshake, an attacker bypasses authentication and dispatches queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and it is not listed in CISA KEV.
An issue was discovered in Shinobi through ocean version 1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.