PT-2022-19722 · Unknown · Universis-Api

Stavros Mekesis · Published 2022-04-25 · Updated 2022-05-04 · CVE-2022-29603

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions UniverSIS-API versions through 1.2.1

Description A SQL Injection issue exists, allowing a remote authenticated attacker to send crafted SQL statements to vulnerable API endpoints, such as /api/students/me/messages/, via the select parameter. This could potentially lead to the retrieval of personal information or modification of grades.

Recommendations For UniverSIS-API versions through 1.2.1, consider restricting access to the vulnerable API endpoints, such as /api/students/me/messages/, until a fix is available. As a temporary workaround, avoid using the select parameter in affected API endpoints to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-29603

Affected Products

Universis-Api

References · 4

• 🔥 https://suumcuique.org/blog/posts/sql-injection-vulnerability-universis · Exploit
• https://gitlab.com/universis/universis-api/-/commit/39e47d7f4654c83296b8de61b243b510c375d3fb · Patch
• https://osv.dev/vulnerability/CVE-2022-29603 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29603 · Security Note