CyberRota Analysis
AI-GeneratedThe vulnerability affects the Decidim participatory democracy framework, specifically in versions prior to 0.30.9, between 0.31.0 and 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2. An authenticated organization administrator can exploit this flaw to execute blind PostgreSQL queries through unsanitized input, potentially allowing them to infer sensitive data based on timing discrepancies. Organizations using affected versions should prioritize upgrading to the patched versions to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.