PT-2023-15887 · Unknown · Nflpick-Em.Com

Published 2023-01-03 · Updated 2024-05-17 · CVE-2022-4871

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nflpick-em.com versions up to 2.2.x

Description A problematic vulnerability was found in nflpick-em.com, affecting the Load Users function of the file html/includes/runtime/admin/JSON/LoadUsers.php. The manipulation of the sort argument leads to SQL injection. The attack can be initiated remotely. Note that the JSON entrypoint is only accessible via an admin account.

Recommendations To fix this issue, apply a patch to nflpick-em.com versions up to 2.2.x. As a temporary workaround, consider restricting access to the LoadUsers.php file or disabling the Load Users function until a patch is available. Additionally, avoid using the sort argument in the affected JSON endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-4871

Affected Products

Nflpick-Em.Com

References · 8

• https://osv.dev/vulnerability/CVE-2022-4871 · Vendor Advisory
• https://github.com/ummmmm/nflpick-em.com/commit/dd77a35942f527ea0beef5e0ec62b92e8b93211e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4871 · Security Note
• https://vuldb.com/?ctiid.217270 · Note
• https://t.me/cvenotify/41637 · Telegram Post
• https://t.me/cvenotify/60148 · Telegram Post
• https://vuldb.com/?id.217270 · Note
• https://t.me/cvenotify/41177 · Telegram Post