PT-2022-16918 · Unknown · Gin-Vue-Admin+1

Piexlmax · Published 2022-04-13 · Updated 2023-03-01 · CVE-2022-24844

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gin-vue-admin versions prior to 2.5.1

Description The issue occurs in the server/service/system/sys auto code pgsql.go code, which means PostgreSQL must be used as the database for this problem to occur. Users must have JWT login and be using PostgreSQL to be affected.

Recommendations For versions prior to 2.5.1, update to version 2.5.1 to resolve the issue. As a temporary workaround, consider disabling the sys auto code pgsql.go service until a patch is available. Restrict access to the PostgreSQL database to minimize the risk of exploitation. Avoid using the JWT login feature in conjunction with PostgreSQL until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-24844

GHSA-5G92-6HPP-W425

Affected Products

Gin-Vue-Admin

Postgresql

References · 9

• 🔥 https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-5g92-6hpp-w425 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24844.json · Exploit
• https://github.com/flipped-aurora/gin-vue-admin/pull/1024 · Patch
• https://osv.dev/vulnerability/CVE-2022-24844 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24844 · Security Note
• https://t.me/cvenotify/28886 · Telegram Post
• https://t.me/cvenotify/28890 · Telegram Post
• https://t.me/cvenotify/30144 · Telegram Post
• https://t.me/cibsecurity/40741 · Telegram Post