PT-2022-16935 · Databasir · Databasir

Luckyt0Mat0 · Published 2022-04-20 · Updated 2022-05-03 · CVE-2022-24861

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Databasir version 1.01

Description Databasir is a team-oriented relational database model document management platform. It has a remote code execution issue due to the lack of validation of JDBC drivers prior to use, which may be provided by system users. This can lead to code execution by any basic user with system access.

Recommendations For Databasir version 1.01, users are advised to upgrade as there are no known workarounds to this issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-24861

GHSA-5R2V-WCWH-7XMP

Affected Products

Databasir

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24861.json · Exploit
• 🔥 https://github.com/vran-dev/databasir/security/advisories/GHSA-5r2v-wcwh-7xmp · Exploit
• https://github.com/vran-dev/databasir/pull/103 · Patch
• https://github.com/vran-dev/databasir/commit/ca22a8fef7a31c0235b0b2951260a7819b89993b · Patch
• https://osv.dev/vulnerability/CVE-2022-24861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24861 · Security Note
• https://t.me/cvenotify/29638 · Telegram Post
• https://t.me/cibsecurity/41195 · Telegram Post