CVE-2022-44291

CRITICALNuclei

WebTareas 2.4p5 - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-44291 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 24, 2025 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryCRITICALWebTareas 2.4p5 - SQL InjectionCVSS 9.8

webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.

Impact

Authenticated attackers can execute time-based blind SQL injection through the id parameter in phasesets.php, potentially extracting sensitive database information including project phases, task data, and user credentials from WebTareas.

Remediation

Update WebTareas to a version later than 2.4p5 that properly sanitizes and parameterizes the id parameter in phasesets.php.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2022sqliwebtareasauthenticatedintrusivewebtareas_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:webtareas_project:webtareas:2.4:p5:*:*:*:*:*:*
http://webtareas.com/ https://github.com/anhdq201/webtareas/issues/1 https://nvd.nist.gov/vuln/detail/CVE-2022-44291 http://webtareas.com/

Source: ProjectDiscovery

References

3