CVE-2022-34876 - Vulnerability Details - OpenCVE

SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.53198.

Key SSVC decision points have not yet been added.

Vendors	Products
Vicidial Subscribe	Vicidial Subscribe

Configuration 1 [-]

cpe:2.3:a:vicidial:vicidial:2.14b0.5:3555:*:*:*:*:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

Upgrade to SVN release 3583 or later.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/rapid7/metasploit-framework/pull/16732
https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af

History

Mon, 14 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.5142}`	epss `{'score': 0.5305}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: rapid7

Published: 2022-07-05T15:40:15.708483Z

Updated: 2024-09-16T17:23:59.824Z

Reserved: 2022-06-30T00:00:00

Link: CVE-2022-34876

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-07-05T16:15:08.033

Modified: 2024-11-21T07:10:21.210

Link: CVE-2022-34876

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-89

{"containers": {"cna": {"affected": [{"product": "VICIdial", "vendor": "VICIdial", "versions": [{"lessThan": "3555", "status": "affected", "version": "2.14b0.5", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "h00die for discovery, disclosure, and exploit. Matt Florell with VICIdial for patching the software."}], "datePublic": "2022-06-30T00:00:00", "descriptions": [{"lang": "en", "value": "SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555."}], "exploits": [{"lang": "en", "value": "https://github.com/rapid7/metasploit-framework/pull/16732"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 SQL Injection", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-07-05T15:40:15", "orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/rapid7/metasploit-framework/pull/16732"}], "solutions": [{"lang": "en", "value": "Upgrade to SVN release 3583 or later."}], "source": {"discovery": "EXTERNAL"}, "title": "VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@rapid7.com", "DATE_PUBLIC": "2022-06-30T21:07:00.000Z", "ID": "CVE-2022-34876", "STATE": "PUBLIC", "TITLE": "VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php."}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "VICIdial", "version": {"version_data": [{"version_affected": "<", "version_name": "2.14b0.5", "version_value": "3555"}]}}]}, "vendor_name": "VICIdial"}]}}, "credit": [{"lang": "eng", "value": "h00die for discovery, disclosure, and exploit. Matt Florell with VICIdial for patching the software."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555."}]}, "exploit": [{"lang": "en", "value": "https://github.com/rapid7/metasploit-framework/pull/16732"}], "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-89 SQL Injection"}]}]}, "references": {"reference_data": [{"name": "https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af", "refsource": "CONFIRM", "url": "https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af"}, {"name": "https://github.com/rapid7/metasploit-framework/pull/16732", "refsource": "MISC", "url": "https://github.com/rapid7/metasploit-framework/pull/16732"}]}, "solution": [{"lang": "en", "value": "Upgrade to SVN release 3583 or later."}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:22:10.815Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/rapid7/metasploit-framework/pull/16732"}]}]}, "cveMetadata": {"assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "assignerShortName": "rapid7", "cveId": "CVE-2022-34876", "datePublished": "2022-07-05T15:40:15.708483Z", "dateReserved": "2022-06-30T00:00:00", "dateUpdated": "2024-09-16T17:23:59.824Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vicidial:vicidial:2.14b0.5:3555:*:*:*:*:*:*", "matchCriteriaId": "8F2D723A-5E19-41E1-8E36-D749C6A6C25F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n SQL en la interfaz de administraci\u00f3n (/vicidial/admin.php) de VICIdial por medio de los par\u00e1metros modify_email_accounts, access_recordings y agentcall_email permite al atacante falsificar la identidad, alterar los datos existentes, permitir la divulgaci\u00f3n completa de todos los datos en el sistema, destruir los datos o deje que no est\u00e9 disponible y convi\u00e9rtase en administrador del servidor de la base de datos. Este problema afecta: VICIdial versiones 2.14b0.5 anteriores a 3555"}], "id": "CVE-2022-34876", "lastModified": "2024-11-21T07:10:21.210", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 8.5, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "cve@rapid7.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-07-05T16:15:08.033", "references": [{"source": "cve@rapid7.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/rapid7/metasploit-framework/pull/16732"}, {"source": "cve@rapid7.com", "tags": ["Vendor Advisory"], "url": "https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/rapid7/metasploit-framework/pull/16732"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af"}], "sourceIdentifier": "cve@rapid7.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "cve@rapid7.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}