Technical impact
The vulnerability is a classic SQL injection flaw triggered by unsanitized user input in the journeyService.updateEntry function within the server/src/nest/journey/journey.controller.t component of liketrek TREK. An attacker who can supply crafted data to the updateEntry endpoint can inject arbitrary SQL commands, potentially allowing the attacker to read, modify or delete data stored in the database, or to gain elevated privileges if the database connection runs with high rights. The CVSS score of 5.3 reflects a moderate severity, but the impact is significant because it can be carried out remotely without any local compromise. Based on the description, it is inferred that the injection could alter the data associated with journey entries or compromise application state.
Affected Systems
Products affected are liketrek TREK version 3.0.22 and earlier. The updateEntry feature resides in the server/src/nest/journey/journey.controller.t component. Users running any release up to and including 3.0.22 are vulnerable until a patch is applied. The fix is included in release 3.1.0.
Risk and Exploitability
The CVSS score of 5.3 indicates a moderate risk and is driven by the ability to execute arbitrary SQL remotely. EPSS is not available, so there is no published estimate of exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring network reachability to the API endpoint. Without a patch, exposed instances can be queried or modified via crafted HTTP requests, potentially giving attackers data exfiltration or integrity compromise capabilities.
