CVE-2022-24260

CRITICALNuclei

voipmonitor voipmonitor Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2022-24260 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Aug 19, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

voipmonitor

Browse voipmonitor / voipmonitor
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALVoipMonitor - Pre-Auth SQL InjectionCVSS 9.8

A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.

Remediation

Apply the latest security patches or updates provided by the vendor to fix the SQL injection vulnerability in the VoipMonitor application.

WeaknessesCWE-89
Authorsgy741
Template tagscvecve2022voipmonitorsqliunauthvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:voipmonitor:voipmonitor:*:*:*:*:*:*:*:*
Shodan: http.title:"VoIPmonitor"
Shodan: http.title:"voipmonitor"
FOFA: title="voipmonitor"
Google: intitle:"voipmonitor"
https://kerbit.io/research/read/blog/3 https://nvd.nist.gov/vuln/detail/CVE-2022-24260 https://www.voipmonitor.org/changelog-gui?major=5 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3