SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)
Fortra · FileCatalyst Workflow
A SQL injection flaw in Fortra FileCatalyst Workflow, affecting version 5.1.6 Build 135 and earlier, allows an attacker to modify application data, potentially including creating administrative users and altering or deleting records in the application database, though data exfiltration is not possible. Exploitation is network-reachable and requires no authentication or user interaction where the Workflow system has anonymous access enabled; otherwise, the attacker must be an authenticated user.
A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this vulnerability. Successful unauthenticated exploitation requires a Workflow system with anonymous access enabled, otherwise an authenticated user is required. This issue affects all versions of FileCatalyst Workflow from 5.1.6 Build 135 and earlier.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 2 years after disclosure. Public exploit code (Metasploit) was available the same day.
- First seen exploitedVulnCheck KEV evidence+2 yrs
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.