PT-2022-20143 · Unknown · Idce Mv'S Application

Iran Macedo · Published 2022-05-27 · Updated 2022-06-10 · CVE-2022-30496

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IDCE MV's application version 1.0

Description The issue allows an attacker to inject SQL payloads in the user field of the Logon Page, potentially connecting to a database to access the enterprise's private and sensitive information.

Recommendations For IDCE MV's application version 1.0, consider restricting access to the Logon Page or disabling the user field until a patch is available to prevent SQL injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-30496

Affected Products

Idce Mv'S Application

References · 4

• 🔥 https://github.com/ifmacedo/mconnect/blob/main/IDCE-SQLi · Exploit
• 🔥 https://linkedin.com/pulse/sql-injection-idce-mv-iran-macedo · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-30496 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30496 · Vendor Advisory