CVE-2022-25506: 
Python vulnerability analysis and mitigation

FreeTAKServer-UI version 1.9.8 was discovered to contain a SQL injection vulnerability in the API endpoint /AuthenticateUser. The vulnerability was disclosed on March 10, 2022, and assigned identifier CVE-2022-25506. This security flaw affects the authentication process of SystemUsers in the FreeTAKServer-UI application (NVD).

The vulnerability exists in the API endpoint /AuthenticateUser where improper input validation allows for SQL injection attacks. The flaw is classified as CWE-89 (SQL Injection). The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, and requiring low privileges (NVD).

If exploited, this vulnerability allows an attacker with a valid API key to execute SQL injection attacks against the SQLite3 database handling authentication. The attacker can retrieve sensitive information including usernames, UserIDs, and clear-text passwords from the SystemUsers table (GitHub Issue).

The vulnerability requires the attacker to possess a valid API key, which could be obtained either through XSS exploitation from an End User Device or through UAV Operator capabilities that broadcast GPS and video feed data. A proof-of-concept exploit has been publicly documented that demonstrates the ability to extract user credentials from the database (GitHub Issue).