PT-2023-15900 · Unknown · Visegripped Stracker

Visegripped · Published 2023-01-15 · Updated 2024-05-17 · CVE-2022-4889

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions visegripped Stracker (affected versions not specified)

Description A critical vulnerability was found in visegripped Stracker. The issue affects the getHistory function of the file doc root/public html/stracker/api.php. The manipulation of the arguments symbol, startDate, and endDate leads to SQL injection.

Recommendations To fix this issue, it is recommended to apply a patch. As a temporary workaround, consider disabling the getHistory function until a patch is available. Restrict access to the doc root/public html/stracker/api.php file to minimize the risk of exploitation. Avoid using the arguments symbol, startDate, and endDate in the affected API endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-4889

Affected Products

Visegripped Stracker

References · 7

• https://github.com/visegripped/stracker/commit/63e1b040373ee5b6c7d1e165ecf5ae1603d29e0a · Patch
• https://github.com/visegripped/stracker/pull/16 · Patch
• https://osv.dev/vulnerability/CVE-2022-4889 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4889 · Security Note
• https://vuldb.com/?id.218377 · Note
• https://t.me/cvenotify/42039 · Telegram Post
• https://vuldb.com/?ctiid.218377 · Note