CVE-2022-25225
HIGHNetwork Olympus 1.8.0 - Authenticated SQL Injection via Event Instance API sqlparameter
Title source: llmDescription
Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation (PostgreSQL) by exploiting this issue.
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://fluidattacks.com/advisories/spinetta/
Product, Vendor Advisory x_refsource_misc
https://www.network-olympus.com/monitoring/
Scores
CVSS v3
7.2
EPSS
0.0278
EPSS Percentile
84.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (1)
softinventive/network_olympus
1.8.0
Published
Mar 10, 2022
Tracked Since
Feb 18, 2026