PT-2022-27170 · Webtareas · Webtareas

Anhdq201 · Published 2022-12-02 · Updated 2022-12-06 · CVE-2022-44291

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions webTareas version 2.4p5

Description The issue is a SQL injection vulnerability. It occurs via the id parameter in the phasesets.php file. This allows for potential exploitation by injecting malicious SQL code.

Recommendations For webTareas version 2.4p5, consider restricting access to the phasesets.php file to minimize the risk of exploitation. Avoid using the id parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-44291

Affected Products

Webtareas

References · 6

• 🔥 https://github.com/anhdq201/webtareas/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2022-44291 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44291 · Security Note
• http://webtareas.com · Note
• https://t.me/cvenotify/39217 · Telegram Post
• https://t.me/cibsecurity/53840 · Telegram Post