Authenticated SQL Injection Vulnerability

This document explains the CVE-2022-47523 - Authenticated SQL Injection Vulnerability that has been reported.

What was the problem?

An authenticated SQL injection vulnerability in Device Control Plus (CVE-2022-47523) was identified which may allow an adversary to execute custom queries and access the database table entries. This has now been fixed by enhancing validation and escaping special characters.

How to fix it?

Upgrading to the latest version is strongly advised due to this vulnerability's severity. To upgrade, follow the steps below:

1. Login to the Device Control Plus console, and click on your current build number in the top right corner.
2. You'll be able to find the latest build applicable to you. Download the PPM and update.