PT-2022-27978 · Trueconf · Trueconf Server

Андрей Ситников + 2 · Published 2022-11-28 · Updated 2026-02-27 · CVE-2022-46764

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TrueConf Server version 5.2.0.10225

Description A SQL injection issue in the web API allows remote unauthenticated attackers to execute arbitrary SQL commands, ultimately leading to remote code execution.

Recommendations For TrueConf Server version 5.2.0.10225, consider disabling the web API until a patch is available to prevent remote code execution. Restrict access to the web API to minimize the risk of exploitation. Avoid using the web API for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2026-04607

CVE-2022-46764

Affected Products

Trueconf Server

References · 13

• 🔥 https://github.com/sldlb/public_cve_submissions/blob/main/CVE-2022-46764.txt · Exploit
• https://osv.dev/vulnerability/CVE-2022-46764 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46764 · Security Note
• https://bdu.fstec.ru/vul/2026-04607 · Security Note
• https://t.me/cveNotify/149408 · Telegram Post
• https://trueconf.ru/products/changelog.html#server-5-2-6 · Note
• https://t.me/cvenotify/49073 · Telegram Post
• https://t.me/cvenotify/118911 · Telegram Post
• https://vuldb.com/?diff.216845 · Note
• https://solidlab.ru/our-news/145-trueconf.html · Note
• https://t.me/cveNotify/153517 · Telegram Post
• https://t.me/cibsecurity/55381 · Telegram Post
• https://t.me/cveNotify/153551 · Telegram Post