PT-2023-15503 · Redgate · Redgate Sql Monitor

Published 2023-04-04 · Updated 2025-02-14 · CVE-2022-47870

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Redgate SQL Monitor version 12.1.31.893

Description A Cross Site Scripting (XSS) issue in the web SQL monitor login page allows remote attackers to inject arbitrary web script or HTML via the returnUrl parameter. This enables attackers to potentially execute malicious code on the client-side.

Recommendations For Redgate SQL Monitor version 12.1.31.893, consider restricting access to the web SQL monitor login page until a patch is available. As a temporary workaround, avoid using the returnUrl parameter in the affected login page to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-47870

Affected Products

Redgate Sql Monitor

References · 6

• 🔥 https://packetstormsecurity.com/files/171647/SQL-Monitor-12.1.31.893-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/51218 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-47870 · Security Note
• https://osv.dev/vulnerability/CVE-2022-47870 · Vendor Advisory
• https://t.me/cvenotify/111466 · Telegram Post
• https://t.me/cibsecurity/61382 · Telegram Post