PT-2022-6345 · Casdoor · Casdoor

Govulnbot · Published 2022-01-22 · Updated 2024-08-21 · CVE-2022-24124

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 1.13.1

Description The query API in Casdoor has a SQL injection issue related to the field and value parameters. This is demonstrated by the "api/get-organizations" endpoint. The vulnerability may allow a remote attacker to gain unauthorized access to protected information due to inadequate protection of the SQL query structure.

Recommendations For versions prior to 1.13.1, update to version 1.13.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the query API or disabling the use of the field and value parameters in the affected endpoint until a patch is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-00991

CVE-2022-24124

GHSA-M358-G4RP-533R

GO-2022-0303

Affected Products

Casdoor

References · 21

• 🔥 https://github.com/casdoor/casdoor/issues/439 · Exploit
• 🔥 https://github.com/casdoor/casdoor/pull/442 · Exploit
• 🔥 https://github.com/ColdFusionX/CVE-2022-24124 · Exploit
• 🔥 https://github.com/b1gdog/CVE-2022-24124 · Exploit
• 🔥 https://github.com/b1gdog/CVE-2022-24124_POC · Exploit
• 🔥 https://github.com/cukw/CVE-2022-24124_POC · Exploit
• 🔥 https://exploit-db.com/exploits/50792 · Exploit
• 🔥 http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html · Exploit
• https://osv.dev/vulnerability/GHSA-m358-g4rp-533r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24124 · Security Note
• https://bdu.fstec.ru/vul/2023-00991 · Security Note
• https://osv.dev/vulnerability/GO-2022-0303 · Vendor Advisory
• https://github.com/casdoor/casdoor · Note
• https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1 · Note