阿里云漏洞库

漏洞描述

A vulnerability was found in oretnom23 Fast Food Ordering System. It has been rated as critical. Affected by this issue is some unknown functionality of the file ffos/admin/reports/index.php. The manipulation of the argument date leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-207422 is the identifier assigned to this vulnerability.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://github.com/0x14dli/ffos-SQL-injection-vulnerability-exists
https://vuldb.com/?id.207422

受影响软件情况

1
#	类型	厂商	产品	版本	影响面
	运行在以下环境
	应用	fast_food_ordering_system_project	fast_food_ordering_system	1.0	-
	运行在以下环境
	系统	alibaba_cloud_linux_2.1903	pcs	*		Up to (excluding) 0.9.169-3.1.al7.3
	运行在以下环境
	系统	amazon_2	pcs	*		Up to (excluding) 0.9.169-3.amzn2.1.2
	运行在以下环境
	系统	anolis_os_7	pcs	*		Up to (excluding) 0.9.169-3
	运行在以下环境
	系统	fedora_EPEL_8	rubygem-rack	*		Up to (excluding) 2.2.4-1.el8
	运行在以下环境
	系统	kylinos_aarch64_V10	pcs	*		Up to (excluding) 0.9.169-3.el7_9.3
	运行在以下环境
	系统	kylinos_aarch64_V10SP1	rubygem-rack	*		Up to (excluding) 2.2.3.1-1.ky10
	运行在以下环境
	系统	kylinos_aarch64_V10SP2	rubygem-rack	*		Up to (excluding) 2.2.3.1-1.ky10
	运行在以下环境
	系统	kylinos_loongarch64_V10SP1	rubygem-rack	*		Up to (excluding) 2.2.3.1-1.a.ky10
	运行在以下环境
	系统	kylinos_x86_64_V10SP1	rubygem-rack	*		Up to (excluding) 2.2.3.1-1.ky10
	运行在以下环境
	系统	kylinos_x86_64_V10SP2	rubygem-rack	*		Up to (excluding) 2.2.3.1-1.ky10
	运行在以下环境
	系统	opensuse_Leap_15.3	ruby2.5-rubygem-rack	*		Up to (excluding) 2.0.8-150000.3.6.1
	运行在以下环境
	系统	opensuse_Leap_15.4	ruby2.5-rubygem-rack	*		Up to (excluding) 2.0.8-150000.3.6.1

攻击路径

网络
攻击复杂度

低
权限要求

低
影响范围

未更改
用户交互

无
可用性

高
保密性

高
完整性

高

CWE-ID	漏洞类型
CWE-89	SQL命令中使用的特殊元素转义处理不恰当（SQL注入）

fast_food_ordering_system_project fast_food_ordering_system sql命令中使用的特殊元素转义处理不恰当（sql注入）

漏洞描述

解决建议

参考链接

受影响软件情况