SQL Injection Vulnerability in Metinfo v7.5.0 by Metinfo
CVE-2022-22295

9.8CRITICAL

Key Information:

Vendor

Metinfo

Status
Metinfo
Vendor
CVE Published:
14 February 2022

What is CVE-2022-22295?

Metinfo v7.5.0 has been discovered to possess a SQL injection vulnerability, specifically located in the parameter_admin.class.php file, which can be exploited via the table_para parameter. This flaw allows attackers to manipulate backend database queries, leading to unauthorized access and data breaches. Proper validation and sanitization of user input are critical to preventing such vulnerabilities.

References

http://note.youdao.com/noteshare?id=2bbcb3b4a5cd232f7a0ad...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.