CVE-2022-38812

MEDIUMNuclei

AeroCMS 0.1.1 - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-38812 has a selected CVSS score of 6.5 (medium); EIP currently links 1 Nuclei template.

Description

AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMAeroCMS 0.1.1 - SQL InjectionCVSS 6.5

AeroCMS 0.1.1 contains a SQL injection caused by unsanitized author parameter, letting attackers execute arbitrary SQL commands, exploit requires crafted author input.

Impact

Authenticated attackers can exploit SQL injection in the author parameter to extract sensitive database information including user credentials, content data, and application configuration from the AeroCMS database.

Remediation

Update AeroCMS to a version newer than 0.1.1 that properly sanitizes the author parameter and uses parameterized queries.

WeaknessesCWE-89
Authorsshivampand3y
Template tagscvecve2022aerocmssqliedbvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
https://www.exploit-db.com/exploits/51022 https://www.nu11secur1ty.com/2022/08/aerocms-v001-sqli.html https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/MegaTKC/2021/AeroCMS-v0.0.1-SQLi https://nvd.nist.gov/vuln/detail/CVE-2022-38812

Source: ProjectDiscovery

References

3