CVE-2022-24260
CRITICAL EXPLOITED IN THE WILD NUCLEIVoipmonitor GUI <v24.96 - Privilege Escalation
Title source: llmExploitation Summary
CVE-2022-24260 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). A Nuclei detection template is also available.
Description
A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level.
Nuclei Templates (1)
VoipMonitor - Pre-Auth SQL Injection
CRITICALby gy741
Shodan:
http.title:"VoIPmonitor" || http.title:"voipmonitor"
FOFA:
title="voipmonitor"
References (2)
Core 2
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://www.voipmonitor.org/changelog-gui?major=5
Exploit, Third Party Advisory x_refsource_misc
https://kerbit.io/research/read/blog/3
Scores
CVSS v3
9.8
EPSS
0.5093
EPSS Percentile
98.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
VulnCheck KEV
2022-08-19
InTheWild.io
2022-08-19
CWE
CWE-89
Status
published
Products (1)
voipmonitor/voipmonitor
< 24.96
Published
Feb 04, 2022
Tracked Since
Feb 18, 2026