Description

Subscriber SQL Injection in Do Lasso <= 358 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-13T14:16:58.323Z",
  "pubdate": "2026-08-13T14:16:58.323Z",
  "executiveSummary": "A Subscriber SQL Injection vulnerability has been identified in the Do Lasso application affecting versions <= 358. This security flaw arises from insufficient input sanitization and improper handling of database queries provided by users holding subscriber-level privileges.\nAn authenticated attacker with low-level subscriber privileges can exploit this vulnerability by supplying specially crafted SQL payloads through vulnerable input vectors within the application. Successful exploitation allows an adversary to manipulate database query logic, leading to unauthorized data access, potential data exfiltration, and manipulation of underlying database contents.\nThe risk implications are severe, as database compromise frequently leads to broader system compromise, including confidentiality and integrity breaches of sensitive application data. The attack vector requires authenticated access at the subscriber tier, meaning the adversary must first provision or compromise a low-privileged account to interact with the vulnerable application logic.\nOrganizations utilizing Do Lasso versions 358 and earlier face significant exposure until proper remediation steps are applied. Immediate focus should be directed toward updating the software or implementing strict input validation controls to mitigate SQL injection vectors.",
  "technicalDetails": "The vulnerability resides within the database query generation mechanics of the Do Lasso application affecting versions <= 358, specifically where subscriber-controlled parameters are concatenated or improperly interpolated into SQL statements without adequate parameterization.\nThe root cause of this vulnerability is the failure to use parameterized queries or prepared statements for database interactions handling subscriber inputs. When input data supplied by a subscriber is directly interpreted as executable SQL syntax by the database management system, the query structure is altered in a manner unintended by the application developers.\nThe attack flow proceeds as follows: First, the authenticated user with subscriber privileges navigates to a vulnerable feature or endpoint that accepts input parameters interacting with the database. Second, the adversary injects malicious SQL commands, such as union-based or boolean-based payloads, into the targeted input field. Third, the application processes the request, constructs the vulnerable SQL query incorporating the unsanitized payload, and executes it against the backend database.\nBecause the application executes the manipulated query under the security context of the database user account configured for the web application, the database returns unauthorized data sets or executes injected administrative commands. The vulnerability requires network exposure of the application interface and valid subscriber authentication credentials.\nPost-exploitation impact includes the potential retrieval of sensitive database tables, enumeration of database schemas, reading of user credentials, and in certain configurations, execution of operating system commands or writing files to the underlying server hosting the database engine."
}