PT-2022-16934 · Databasir · Databasir

Luckyt0Mat0 · Published 2022-04-19 · Updated 2022-04-29 · CVE-2022-24860

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Databasir version 1.01

Description Databasir is a team-oriented relational database model document management platform. It has a Use of Hard-coded Cryptographic Key issue. An attacker can use hard coding to generate login credentials of any user and log in to the service background located at different IP addresses.

Recommendations For Databasir version 1.01, as a temporary workaround, consider restricting access to the service background to minimize the risk of exploitation. Avoid using hard-coded cryptographic keys in the login process until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

CVE-2022-24860

GHSA-9PRP-5JC9-JPGG

Affected Products

Databasir

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24860.json · Exploit
• 🔥 https://github.com/vran-dev/databasir/blob/master/core/src/main/java/com/databasir/core/infrastructure/jwt/JwtTokens.java · Exploit
• https://osv.dev/vulnerability/CVE-2022-24860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24860 · Security Note
• https://github.com/vran-dev/databasir/security/advisories/GHSA-9prp-5jc9-jpgg · Note
• https://user-images.githubusercontent.com/75008428/163742566-a69c91e8-db20-4058-8967-1cfe86facc6d.png · Note
• https://t.me/cibsecurity/41159 · Telegram Post
• https://user-images.githubusercontent.com/75008428/163742517-ecc1c787-1ef6-4df9-bdf2-407b2b31e111.png · Note
• https://t.me/cvenotify/29187 · Telegram Post
• https://user-images.githubusercontent.com/75008428/163742596-5c13153a-be8f-4ce3-9681-bc68b5f7e9c5.png · Note