CVE-2022-34876

🗓️ 05 Jul 2022 15:40:15Reported by rapid7Type

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 72 Views🌐 WEB

SQL Injection vulnerability in VICIdial admin interfac

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2022-34876	30 Jun 202221:07	–	attackerkb
Circl	CVE-2022-34876	5 Jul 202220:13	–	circl
CNNVD	VICIdial SQL注入漏洞	5 Jul 202200:00	–	cnnvd
Cvelist	CVE-2022-34876 VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.	5 Jul 202215:40	–	cvelist
NVD	CVE-2022-34876	5 Jul 202216:15	–	nvd
OSV	CVE-2022-34876	5 Jul 202216:15	–	osv
Packet Storm	VICIdial Multiple Authenticated SQL Injection	1 Sep 202400:00	–	packetstorm
Prion	Sql injection	5 Jul 202216:15	–	prion
Rapid7 Blog	Metasploit Weekly Wrap-Up	23 Sep 202218:50	–	rapid7blog

NVD

Node

vicidial vicidialMatch2.14b0.53555

[
  {
    "product": "VICIdial",
    "vendor": "VICIdial",
    "versions": [
      {
        "lessThan": "3555",
        "status": "affected",
        "version": "2.14b0.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
vicidial	www.vicidial.org/VICIDIALforum/viewtopic.php
github	www.github.com/rapid7/metasploit-framework/pull/16732

Parameter	Position	Path	Description	CWE
modify_email_accounts	request body	vicidial/admin.php	SQL injection in admin interface via modify_email_accounts parameter	CWE-89
access_recordings	request body	vicidial/admin.php	SQL injection in admin interface via access_recordings parameter	CWE-89
agentcall_email	request body	vicidial/admin.php	SQL injection in admin interface via agentcall_email parameter	CWE-89
agent	query param	vicidial/AST_agent_time_sheet.php	SQL injection in AST_agent_time_sheet via agent parameter	CWE-89
file_download	query param	vicidial/user_stats.php	SQL injection in user_stats via file_download parameter	CWE-89