CyberRota Analysis
AI-GeneratedThe vulnerability affects the '/ws/apiprensa/getVideo' endpoint, where improper validation of the GET parameter `id_ambito` allows for SQL injection attacks. This can lead to syntax errors and the exposure of sensitive database error messages, indicating a lack of input sanitization and prepared statements. Organizations utilizing this endpoint should prioritize remediation to prevent potential data breaches and unauthorized access to their databases.
Original NVD Description
The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via PDOException. This confirms that user input is being incorporated directly into SQL statements without proper sanitization or the use of prepared statements.