Description
An SQL Injection vulnerability in the Management Console (Operator Audit Trail) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database, recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system.
References (1)
Core 1
Core References
Mitigation, Vendor Advisory
https://support.blackberry.com/kb/articleDetail?articleNumber=000112406
Scores
CVSS v3
7.2
EPSS
0.0049
EPSS Percentile
38.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (1)
blackberry/athoc
7.15
Published
Sep 12, 2023
Tracked Since
Feb 18, 2026