Vulnonym.com

CVE-2026-25947 - Baldpated Lady

Description

Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Reference

https://github.com/Worklenz/worklenz/commit/76e5cb0f5dd566fb65586cd3db30ee951c92a32b https://github.com/Worklenz/worklenz/releases/tag/v2.1.7 https://github.com/Worklenz/worklenz/security/advisories/GHSA-f2f8-2ppj-85pf

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

8.8

Base Severity

HIGH

Remediation Step-by-Step Guide

  1. Upgrade to Version v2.1.7 or Later
    Immediately update all instances of Worklenz to version v2.1.7 or any subsequent stable release. Verify the upgrade by checking the application’s version banner or API endpoint /api/version (if available).

  2. Validate Patch Application
    Confirm the patch was applied correctly by reviewing release notes, checksums, or digital signatures provided by the vendor. Rebuild and redeploy the application if using containerized or automated deployment pipelines.

  3. Review and Sanitize Input Handling
    Audit all backend code paths related to project, task, reporting, financial data, socket.io handlers, and scheduling features. Replace dynamic SQL string concatenation with parameterized queries or prepared statements using ORM frameworks (e.g., Sequelize, Hibernate, Entity Framework).

  4. Implement Input Validation and Whitelisting
    Enforce strict input validation on all user-supplied data. Use allowlists for acceptable characters and formats (e.g., alphanumeric, dates, IDs). Reject or sanitize any input containing SQL metacharacters (', ;, --, /*, etc.).

  5. Deploy Web Application Firewall (WAF) Rules
    Configure WAF rules to detect and block common SQL injection payloads (e.g., 1' OR '1'='1, UNION SELECT). Use OWASP Core Rule Set (CRS) or vendor-specific SQLi detection signatures.

  6. Conduct Penetration Testing and Code Review
    Perform targeted penetration tests focusing on the affected endpoints. Conduct a manual code review of all database interaction layers to ensure no other injection vectors exist.

  7. Monitor and Log Database Queries
    Enable detailed database query logging with anomaly detection. Alert on unusual patterns such as multiple failed queries, UNION-based payloads, or high-volume data extraction attempts.

  8. Rotate Database Credentials and Audit Access
    Rotate all database credentials used by Worklenz. Review and minimize database user permissions—ensure least privilege is enforced (e.g., no DROP, ALTER, or LOAD DATA permissions for application users).

  9. Update Incident Response Plan
    Document the vulnerability and remediation steps in your incident response playbook. Train staff on recognizing signs of SQL injection attacks and escalation procedures.

  10. Verify Remediation with Automated Scans
    Run DAST (Dynamic Application Security Testing) and SAST (Static Application Security Testing) tools (e.g., OWASP ZAP, SonarQube, Checkmarx) to confirm no SQL injection vulnerabilities remain.

Context within ISO/IEC 27001 and NIST Frameworks

ISO/IEC 27001 Controls

This SQL injection vulnerability directly impacts the following ISO/IEC 27001 controls under Annex A:

  • A.9.4.1 – Access control to operating systems — Unauthorized database access via injection could bypass application-layer controls.
  • A.12.3.1 – Management of technical vulnerabilities — Failure to patch known vulnerabilities violates the requirement for timely remediation.
  • A.12.6.1 – Technical vulnerability management — Requires systematic identification, assessment, and remediation of technical flaws.
  • A.14.2.3 – Secure development lifecycle — Lack of secure coding practices (e.g., input sanitization) indicates failure in secure development processes.
  • A.18.2.3 – Monitoring activities — Inadequate logging and monitoring of database queries prevents detection of exploitation attempts.

NIST SP 800-53 Controls

This vulnerability maps to the following NIST SP 800-53 Rev. 4 controls:

  • SI-2 – System Monitoring — Requires continuous monitoring for malicious activity, including SQL injection attempts.
  • SI-4 – Audit and Accountability — Insufficient logging of database queries prevents traceability of exploitation events.
  • SI-7 – Software and Information Integrity — Failure to apply patches violates the requirement to maintain software integrity.
  • SI-10 – Information Input Validation — Direct exploitation through unvalidated inputs violates mandatory input validation controls.
  • CA-7 – Security Assessment and Authorization — Inadequate assessment of third-party software (Worklenz) prior to deployment.
  • RA-5 – Risk Assessment — Failure to identify and mitigate known SQL injection risks in critical systems.
  • SC-28 – Protection of Information at Rest and in Transit — SQLi can lead to exfiltration of sensitive financial and project data, compromising confidentiality.

Recommendation: Treat this vulnerability as a high-risk control failure under both frameworks. Prioritize remediation within 72 hours per ISO/IEC 27001 A.12.6.1 and NIST SI-7, and conduct a full risk reassessment per RA-5 before reauthorizing system use.