Vulnerability Details : CVE-2022-45030

A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secure-file-priv).

Vulnerability category: Sql Injection

Published 2023-04-15 02:15:07

Updated 2023-04-24 19:01:15

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-45030

Probability of exploitation activity in the next 30 days: 0.07%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 27 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2022-45030

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	[email protected]
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-45030

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Assigned by: [email protected] (Primary)

References for CVE-2022-45030

http://packetstormsecurity.com/files/171613/rconfig-3.9.7-SQL-Injection.html

Exploit;Third Party Advisory;VDB Entry
https://www.rconfig.com/downloads/rconfig-3.9.7.zip

Product

Products affected by CVE-2022-45030

Rconfig » Rconfig » Version: 3.9.7
cpe:2.3:a:rconfig:rconfig:3.9.7:*:*:*:*:*:*:*
Matching versions