CVE-2022-34878

🗓️ 05 Jul 2022 15:40:27Reported by rapid7Type

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 103 Views🌐 WEB

SQL Injection vulnerability in VICIdial user_stats.php

Reporter	Title	Published	Views	Family All 12
attackerkb	CVE-2022-34878	30 Jun 202221:07	–	attackerkb
Circl	CVE-2022-34878	22 Sep 202215:12	–	circl
CNNVD	VICIdial SQL注入漏洞	5 Jul 202200:00	–	cnnvd
Cvelist	CVE-2022-34878 VICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.	5 Jul 202215:40	–	cvelist
Mend	CVE-2022-34878	5 Jul 202215:40	–	mend
NVD	CVE-2022-34878	5 Jul 202216:15	–	nvd
OSV	CVE-2022-34878	5 Jul 202216:15	–	osv
Packet Storm	VICIdial Multiple Authenticated SQL Injection	1 Sep 202400:00	–	packetstorm
Prion	Sql injection	5 Jul 202216:15	–	prion
Positive Technologies	PT-2022-22413	5 Jul 202200:00	–	ptsecurity

NVD

Vulners

Node

vicidial vicidialMatch2.14b0.53555

[
  {
    "product": "VICIdial",
    "vendor": "VICIdial",
    "versions": [
      {
        "lessThan": "3555",
        "status": "affected",
        "version": "2.14b0.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/rapid7/metasploit-framework/pull/16732
vicidial	www.vicidial.org/VICIDIALforum/viewtopic.php

Parameter	Position	Path	Description	CWE
file_download	query param	/vicidial/user_stats.php	SQL injection in vicidial/user_stats.php via the file_download parameter.	CWE-89
modify_email_accounts	request body	/vicidial/admin.php	SQL injection in vicidial/admin.php via the modify_email_accounts parameter (POST data).	CWE-89
access_recordings	request body	/vicidial/admin.php	SQL injection in vicidial/admin.php via the access_recordings parameter (POST data).	CWE-89
agentcall_email	request body	/vicidial/admin.php	SQL injection in vicidial/admin.php via the agentcall_email parameter (POST data).	CWE-89
agent	query param	/vicidial/AST_agent_time_sheet.php	SQL injection in vicidial/AST_agent_time_sheet.php via the agent parameter in the query string.	CWE-89