PT-2022-20140 · Unknown · Oretnom23 Automotive Shop Management System

N1_X · Published 2022-05-26 · Updated 2022-06-03 · CVE-2022-30493

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions oretnom23 Automotive Shop Management System version 1.0

Description The issue allows remote attackers to exploit a blind SQL Injection Vulnerability through the product id parameter. This vulnerability enables attackers to dump all database credentials and gain admin access, resulting in privilege escalation.

Recommendations For oretnom23 Automotive Shop Management System version 1.0, consider restricting access to the product id parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the product id parameter in sensitive operations until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-30493

Affected Products

Oretnom23 Automotive Shop Management System

References · 4

• 🔥 https://github.com/nsparker1337/OpenSource/blob/main/exploit_sql_asms.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-30493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30493 · Security Note
• https://t.me/cvenotify/31084 · Telegram Post