PT-2022-16558 · Unknown · Aceweb Online Portal

Published 2022-05-27 · Updated 2022-06-11 · CVE-2022-24240

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ACEweb Online Portal version 3.5.065

Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the criteria parameter in the showschedule.awp endpoint.

Recommendations For ACEweb Online Portal version 3.5.065, consider restricting access to the showschedule.awp endpoint until a patch is available. As a temporary workaround, avoid using the criteria parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-24240

Affected Products

Aceweb Online Portal

References · 6

• https://osv.dev/vulnerability/CVE-2022-24240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24240 · Security Note
• https://aceware.com/forum/viewtopic.php?f=7&t=481 · Vendor Advisory
• http://aceweb.com · Note
• https://t.me/cibsecurity/43675 · Telegram Post
• http://aceware.com · Note