CVE-2022-42744

2022-11-0300:00:00

Fluid Attacks

www.cve.org

candidats

sqli

crud operations

cve-2022-42744

AI Score

9.6

Confidence

High

EPSS

0.003

Percentile

65.8%

JSON

CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi attacks.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "CandidATS",
    "versions": [
      {
        "version": "3.0.0",
        "status": "affected"
      }
    ]
  }
]

References

candidats.net/

fluidattacks.com/advisories/mohawke/