Exposed BI tool with unauthenticated SQL injection.
An internal analytics instance was reachable from the public internet and exposed a path to sensitive company data.
- Discovered (complete)
- Proven (complete)
- Fixed (not yet published)
- Retested (not yet published)
What they were shipping
Internal analytics for the business. Not part of the product the customer sells.
What we found
A business-intelligence instance meant for internal use was reachable from the public internet, and an unauthenticated request could inject SQL into queries it ran against company data.
How we proved it
We confirmed the instance was reachable without authentication and that the injection point was exploitable, then stopped. Evidence was kept to the minimum needed to establish impact.
Business impact
An attacker could read the data the analytics instance had access to, which is typically the company's most consolidated view of its customers and revenue.
Fix
Take the instance off the public internet, put it behind authentication and a network boundary, and patch the injectable component.
Retest
Retest status not published for this case.