CVE-2022-25322

CRITICALNuclei

zerof web_server Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2022-25322 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

ZEROF Web Server 2.0 allows /HandleEvent SQL Injection.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 22, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

web_server

Browse zerof / web_server
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALZEROF Web Server 2.0 - SQL InjectionCVSS 9.8

ZEROF Web Server 2.0 allows SQL Injection via the /HandleEvent endpoint. Attackers can exploit this vulnerability by manipulating the request parameters to execute arbitrary SQL queries.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Apply the latest security patches or updates provided by the vendor to fix the SQL Injection vulnerability in ZEROF Web Server 2.0.

WeaknessesCWE-89
Authorsdaffainfo
Template tagscvecve2022zerofsqlivkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:zerof:web_server:2.0:*:*:*:*:*:*:*
Shodan: Server: ZEROF Web Server
https://github.com/landigv/research/blob/main/cve/CVE-2022-25322.md https://nvd.nist.gov/vuln/detail/CVE-2022-25322

Source: ProjectDiscovery

References

3