PT-2022-27308 · Unknown · Appalti & Contratti

Published 2022-11-21 · Updated 2025-04-29 · CVE-2022-44785

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Appalti & Contratti version 9.12.2

Description An issue was discovered in the target web applications, which are subject to multiple SQL Injection vulnerabilities. Some of these vulnerabilities are executable even by unauthenticated users, as demonstrated by the cfamm parameter in the "GetListaEnti.do" endpoint.

Recommendations For Appalti & Contratti version 9.12.2, consider disabling the cfamm parameter in the "GetListaEnti.do" endpoint as a temporary workaround until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-44785

Affected Products

Appalti & Contratti

References · 6

• 🔥 https://members.backbox.org/maggioli-appalti-contratti-multiple-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2022-44785 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44785 · Security Note
• https://t.me/cvenotify/120215 · Telegram Post
• https://t.me/cvenotify/38178 · Telegram Post
• https://t.me/cibsecurity/53295 · Telegram Post