PT-2022-25569 · Unknown · Ndkadvancedcustomizationfields

Dalii · Published 2022-11-01 · Updated 2025-05-06 · CVE-2022-40839

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NdkAdvancedCustomizationFields version 3.5.0

Description A SQL injection issue in the height and width parameters allows unauthenticated attackers to exfiltrate database data.

Recommendations For NdkAdvancedCustomizationFields version 3.5.0, avoid using the height and width parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-40839

Affected Products

Ndkadvancedcustomizationfields

References · 7

• 🔥 https://github.com/daaaalllii/cve-s/blob/main/CVE-2022-40839/poc.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-40839 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40839 · Vendor Advisory
• https://t.me/cibsecurity/52399 · Telegram Post
• https://t.me/cvenotify/121031 · Telegram Post
• http://ndkadvancedcustomizationfields.com · Note
• http://ndk.com · Note