PT-2022-27188 · Unknown · Sanitization Management System

Bgp-Ospf · Published 2022-12-02 · Updated 2022-12-03 · CVE-2022-44348

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sanitization Management System version 1.0

Description The issue concerns SQL Injection via the "/php-sms/admin/orders/update status.php?id=" endpoint. This allows for potential manipulation of database queries by injecting malicious SQL code. The id parameter is vulnerable to this type of attack.

Recommendations For Sanitization Management System version 1.0, as a temporary workaround, consider restricting access to the "/php-sms/admin/orders/update status.php?id=" endpoint until a patch is available. Avoid using the id parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-44348

Affected Products

Sanitization Management System

References · 5

• 🔥 https://github.com/BGP-OSPF/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-3.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-44348 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44348 · Security Note
• https://t.me/cibsecurity/53820 · Telegram Post
• https://t.me/cvenotify/39053 · Telegram Post