CVE-2022-42744

CRITICAL

CandidATS 3.0.0 - SQL Injection via entriesPerPage Parameter

Title source: llm

Description

CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi attacks.

References (2)

Core 2

Core References

Product

https://candidats.net/

Exploit, Third Party Advisory

https://fluidattacks.com/advisories/mohawke/

Scores

CVSS v3 9.8

EPSS 0.0120

EPSS Percentile 64.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-89

Status published

Products (1)

auieo/candidats 3.0.0

Published Nov 03, 2022

Tracked Since Feb 18, 2026