PT-2023-15900 · Unknown · Visegripped Stracker

Visegripped · Publicado 2023-01-15 · Atualizado 2024-05-17 · CVE-2022-4889

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions visegripped Stracker (affected versions not specified)

Description A critical vulnerability was found in visegripped Stracker. The issue affects the getHistory function of the file doc root/public html/stracker/api.php. The manipulation of the arguments symbol, startDate, and endDate leads to SQL injection.

Recommendations To fix this issue, it is recommended to apply a patch. As a temporary workaround, consider disabling the getHistory function until a patch is available. Restrict access to the doc root/public html/stracker/api.php file to minimize the risk of exploitation. Avoid using the arguments symbol, startDate, and endDate in the affected API endpoint until the issue is resolved.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2022-4889

Produtos afetados

Visegripped Stracker

Referências · 7

• https://github.com/visegripped/stracker/commit/63e1b040373ee5b6c7d1e165ecf5ae1603d29e0a · Correção
• https://github.com/visegripped/stracker/pull/16 · Correção
• https://vuldb.com/?id.218377 · Nota
• https://t.me/cvenotify/42039 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-4889 · Aviso do Fabricante
• https://vuldb.com/?ctiid.218377 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-4889 · Nota de Segurança