CVE-2016-4999

Critical

Published: 05/08/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

CVE-2016-4999 is a SQL injection vulnerability in the getStringParameterSQL method in Dashbuilder before version 0.6.0.Beta1. It allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the Data Set Authoring or Displayer editor UI.

Risk Assessment

An attacker can exploit this vulnerability to gain control over the database, potentially leading to data disclosure or modification. This risk can severely impact the integrity and confidentiality of data within the organization.

Recommendation

It is recommended to update Dashbuilder to version 0.6.0.Beta1 or later to mitigate this vulnerability. Additionally, conducting a security audit of the application to identify other potential vulnerabilities is advisable.

Original NVD description (English source)

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.