CVE-2022-34876

🗓️ 05 Jul 2022 15:40:15Reported by rapid7Type

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 80 Views🌐 WEB

SQL Injection vulnerability in VICIdial admin interfac

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2022-34876	30 Jun 202221:07	–	attackerkb
Circl	CVE-2022-34876	5 Jul 202220:13	–	circl
CNNVD	VICIdial SQL注入漏洞	5 Jul 202200:00	–	cnnvd
Cvelist	CVE-2022-34876 VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.	5 Jul 202215:40	–	cvelist
NVD	CVE-2022-34876	5 Jul 202216:15	–	nvd
OSV	CVE-2022-34876	5 Jul 202216:15	–	osv
Packet Storm	VICIdial Multiple Authenticated SQL Injection	1 Sep 202400:00	–	packetstorm
Prion	Sql injection	5 Jul 202216:15	–	prion
Rapid7 Blog	Metasploit Weekly Wrap-Up	23 Sep 202218:50	–	rapid7blog

NVD

Node

vicidial vicidialMatch2.14b0.53555

[
  {
    "product": "VICIdial",
    "vendor": "VICIdial",
    "versions": [
      {
        "lessThan": "3555",
        "status": "affected",
        "version": "2.14b0.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
vicidial	www.vicidial.org/VICIDIALforum/viewtopic.php
github	www.github.com/rapid7/metasploit-framework/pull/16732

Parameter	Position	Path	Description	CWE
modify_email_accounts	request body	vicidial/admin.php	SQL injection in vicidial/admin.php via multiple parameters in admin page authentication context.	CWE-89
access_recordings	request body	vicidial/admin.php	SQL injection in vicidial/admin.php via multiple parameters in admin page authentication context.	CWE-89
agentcall_email	request body	vicidial/admin.php	SQL injection in vicidial/admin.php via multiple parameters in admin page authentication context.	CWE-89
agent	query param	vicidial/AST_agent_time_sheet.php	SQL injection in vicidial/AST_agent_time_sheet.php through the agent GET parameter.	CWE-89
file_download	query param	vicidial/user_stats.php	SQL injection in vicidial/user_stats.php via the file_download GET parameter.	CWE-89
modify_email_accounts	request body	vicidial/admin.php	Authenticated SQL injection points in vicidial/admin.php for modifying users and related actions.	CWE-89
access_recordings	request body	vicidial/admin.php	Authenticated SQL injection points in vicidial/admin.php for modifying users and related actions.	CWE-89
agentcall_email	request body	vicidial/admin.php	Authenticated SQL injection points in vicidial/admin.php for modifying users and related actions.	CWE-89
modify_email_accounts	request body	vicidial/admin.php	Aggregate view of multiple authenticated SQL injection vectors in vicidial/admin.php (modify_email_accounts, access_recordings, agentcall_email).	CWE-89
access_recordings	request body	vicidial/admin.php	Aggregate view of multiple authenticated SQL injection vectors in vicidial/admin.php (modify_email_accounts, access_recordings, agentcall_email).	CWE-89