CVE-2021-39165: 
PHP vulnerability analysis and mitigation

Cachet, an open source status page system, was found to contain a SQL injection vulnerability in versions prior to and including 2.3.18. The vulnerability exists in the SearchableTrait#scopeSearch() function. This issue was discovered in August 2021 and was assigned CVE-2021-39165 (GitHub Advisory).

The vulnerability exists in the SearchableTrait#scopeSearch() function where there was improper validation of searchable columns used in database queries. The issue allowed attackers to manipulate search parameters to perform SQL injection attacks. The fix involved implementing proper validation by ensuring only allowed searchable columns are used in database queries through the use of arrayintersectkey() function (GitHub Commit).

Attackers without authentication could exploit this vulnerability to exfiltrate sensitive data from the database, including administrator passwords and session information (GitHub Advisory, Sonar).

Since the original CachetHQ/Cachet repository was not active at the time, users were advised to upgrade to version 2.5.0 or later from the forking repository at fiveai/Cachet to address this vulnerability (GitHub Advisory).