CVE-2022-48603: 
ScienceLogic SL1 Agent vulnerability analysis and mitigation

A SQL injection vulnerability was discovered in the 'message viewer iframe' feature of ScienceLogic SL1. The vulnerability, identified as CVE-2022-48603, was found to process unsanitized user-controlled input directly into SQL queries, enabling potential arbitrary SQL injection attacks. The vulnerability affects ScienceLogic SL1 versions 11.1.2 and earlier. The issue was initially reported to the vendor on September 6, 2022, and was publicly disclosed on August 9, 2023 (Securifera Advisory).

The vulnerability has been assigned a CVSS v3.1 score of 8.8 (High), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs low privileges, requires no user interaction, and can potentially result in high impacts to confidentiality, integrity, and availability (Securifera Advisory).

The vulnerability allows attackers to inject arbitrary SQL queries into the database, potentially leading to unauthorized access to sensitive data, manipulation of database contents, and compromise of system integrity. The high CVSS score indicates severe potential consequences if successfully exploited (Securifera Advisory).

The vulnerability requires low attack complexity and low privileges to exploit, making it relatively accessible to attackers. The network attack vector means it can be exploited remotely. No public exploits have been explicitly documented (Securifera Advisory).

Users are advised to update to the latest version of ScienceLogic SL1 beyond version 11.1.2. The vendor has released patches to address this vulnerability (Securifera Advisory).

The disclosure process faced significant resistance from the vendor, who initially refused CVE issuance and disclosure. The vendor hired a law firm to manage the disclosure process, and their legal team strongly advised against disclosing to MITRE. Despite these challenges, the vulnerability was eventually publicly disclosed (Securifera Advisory).