IPFire versions prior to 2.29 (Core Update 198) contain a SQL injection vulnerability that allows an authenticated attacker manipulate the query used when viewing OpenVPN connection logs via CONNECTION_NAME parameter. When range of logs, application issues HTTP POST request Request-URI /cgi-bin/logs.cgi/ovpnclients.dat and inserts value parameter directly into WHERE clause without proper sanitization or parameterization. The unsanitized can alter executed be disclose sensitive information from database.