CVE-2022-34878

🗓️ 05 Jul 2022 15:40:27Reported by rapid7Type

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 79 Views🌐 WEB

SQL Injection vulnerability in VICIdial user_stats.php

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2022-34878	30 Jun 202221:07	–	attackerkb
Circl	CVE-2022-34878	22 Sep 202215:12	–	circl
CNNVD	VICIdial SQL注入漏洞	5 Jul 202200:00	–	cnnvd
Cvelist	CVE-2022-34878 VICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.	5 Jul 202215:40	–	cvelist
NVD	CVE-2022-34878	5 Jul 202216:15	–	nvd
OSV	CVE-2022-34878	5 Jul 202216:15	–	osv
Packet Storm	VICIdial Multiple Authenticated SQL Injection	1 Sep 202400:00	–	packetstorm
Prion	Sql injection	5 Jul 202216:15	–	prion
Rapid7 Blog	Metasploit Weekly Wrap-Up	23 Sep 202218:50	–	rapid7blog

NVD

Node

vicidial vicidialMatch2.14b0.53555

[
  {
    "product": "VICIdial",
    "vendor": "VICIdial",
    "versions": [
      {
        "lessThan": "3555",
        "status": "affected",
        "version": "2.14b0.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
vicidial	www.vicidial.org/VICIDIALforum/viewtopic.php
github	www.github.com/rapid7/metasploit-framework/pull/16732

Parameter	Position	Path	Description	CWE
file_download	query param	/vicidial/user_stats.php	SQL injection via file_download parameter in user_stats.php	CWE-89
modify_email_accounts	request body	/vicidial/admin.php	SQL injection via modify_email_accounts parameter in admin.php	CWE-89
access_recordings	request body	/vicidial/admin.php	SQL injection via access_recordings parameter in admin.php	CWE-89
agentcall_email	request body	/vicidial/admin.php	SQL injection via agentcall_email parameter in admin.php	CWE-89
agent	query param	/vicidial/AST_agent_time_sheet.php	SQL injection via agent parameter in AST_agent_time_sheet.php	CWE-89