CVE-2026-48114— National Center for Ecological Analysis and Synthesis Metacat 授权问题漏洞

Metacat has an unauthenticated SQL injection vulnerability

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVEST_SITE_SCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Three request parameters reach the sink: unit, contactEmail, and documentListURL. The servlet does not verify a real LDAP identity. Allowing the vulnerable insert to proceed. Since the PostgreSQL backend permits stacked queries via Statement.executeUpdate(), this vulnerability allows full read/write/execute access in the Metacat database context. The vulnerability was remediated in Metacat 3.0.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

National Center for Ecological Analysis and Synthesis Metacat 授权问题漏洞

National Center for Ecological Analysis and Synthesis Metacat是National Center for Ecological Analysis and Synthesis组织的一个数据管理平台。 National Center for Ecological Analysis and Synthesis Metacat 2.0.0版本及以上版本存在安全漏洞，该漏洞源于在/harvesterRegistration端点存在未经验证的SQL注入，Har

N/A

N/A