PT-2022-27127 · Unknown · Rainygao Docsys

Archvitio · Published 2022-12-12 · Updated 2022-12-13 · CVE-2022-4416

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions RainyGao DocSys (affected versions not specified)

Description A critical issue has been identified, affecting the getReposAllUsers function of the file /DocSystem/Repos/getReposAllUsers.do. The manipulation of the searchWord/reposId argument leads to SQL injection. This issue can be exploited remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Neutralization

SQL injection

Weakness Enumeration

CWE-707

CWE-89

Related Identifiers

CVE-2022-4416

Affected Products

Rainygao Docsys

References · 6

• 🔥 https://gitee.com/RainyGao/DocSys/issues/I65QEE · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-4416 · Security Note
• https://vuldb.com/?id.215278 · Note
• https://t.me/cvenotify/39609 · Telegram Post
• https://t.me/cvenotify/39627 · Telegram Post
• https://t.me/cvenotify/39761 · Telegram Post