While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this action.
Date: 2025-05
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-3893
CWE: CWE-89

While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this action. Input provided by the the user is not sanitized, leading to SQL Injection vulnerability. Version 5.20 of MegaBIP fixes this issue.


Mitigations:

Architectural layers (MAESTRO):