CyberRota Analysis
AI-GeneratedThe vulnerability arises from the unsanitized `limit_videos` parameter in the endpoint `/ws/apitribuna/ultimosVideos`, allowing remote attackers to perform error-based SQL injection. This could lead to unauthorized access to internal database error messages and stack traces, potentially exposing sensitive implementation details. Organizations utilizing this endpoint should prioritize remediation to mitigate the risk of data breaches and unauthorized database manipulation.
Original NVD Description
A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and potentially manipulate backend queries. The issue results in an error-based SQL injection and exposes internal database error messages and stack traces, revealing implementation details of the backend system.