CVE-2022-34877 - Vulnerability Details - OpenCVE

SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:N/AC:L/Au:S/C:C/I:C/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Vicidial	Vicidial

Configuration 1 [-]

cpe:2.3:a:vicidial:vicidial:2.14b0.5:3555:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/rapid7/metasploit-framework/pull/16732
https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af

History

No history.

MITRE

Status: PUBLISHED

Assigner: rapid7

Published: 2022-07-05T15:40:19.992008Z

Updated: 2024-09-17T04:09:36.869Z

Reserved: 2022-06-30T00:00:00

Link: CVE-2022-34877

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-07-05T16:15:08.167

Modified: 2024-11-21T07:10:21.343

Link: CVE-2022-34877

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "VICIdial", "vendor": "VICIdial", "versions": [{"lessThan": "3555", "status": "affected", "version": "2.14b0.5", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "h00die for discovery, disclosure, and exploit. Matt Florell with VICIdial for patching the software."}], "datePublic": "2022-06-30T00:00:00", "descriptions": [{"lang": "en", "value": "SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555."}], "exploits": [{"lang": "en", "value": "https://github.com/rapid7/metasploit-framework/pull/16732"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 SQL Injection", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-07-05T15:40:19", "orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/rapid7/metasploit-framework/pull/16732"}], "solutions": [{"lang": "en", "value": "Upgrade to SVN release 3583 or later."}], "source": {"discovery": "EXTERNAL"}, "title": "VICIDial 2.14b0.5 SVN 3550 was discovered to contains a SQL injection vulnerability at /vicidial/AST_agent_time_sheet.php.", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@rapid7.com", "DATE_PUBLIC": "2022-06-30T21:31:00.000Z", "ID": "CVE-2022-34877", "STATE": "PUBLIC", "TITLE": "VICIDial 2.14b0.5 SVN 3550 was discovered to contains a SQL injection vulnerability at /vicidial/AST_agent_time_sheet.php."}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "VICIdial", "version": {"version_data": [{"version_affected": "<", "version_name": "2.14b0.5", "version_value": "3555"}]}}]}, "vendor_name": "VICIdial"}]}}, "credit": [{"lang": "eng", "value": "h00die for discovery, disclosure, and exploit. Matt Florell with VICIdial for patching the software."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555."}]}, "exploit": [{"lang": "en", "value": "https://github.com/rapid7/metasploit-framework/pull/16732"}], "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-89 SQL Injection"}]}]}, "references": {"reference_data": [{"name": "https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af", "refsource": "CONFIRM", "url": "https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af"}, {"name": "https://github.com/rapid7/metasploit-framework/pull/16732", "refsource": "MISC", "url": "https://github.com/rapid7/metasploit-framework/pull/16732"}]}, "solution": [{"lang": "en", "value": "Upgrade to SVN release 3583 or later."}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:22:10.821Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/rapid7/metasploit-framework/pull/16732"}]}]}, "cveMetadata": {"assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "assignerShortName": "rapid7", "cveId": "CVE-2022-34877", "datePublished": "2022-07-05T15:40:19.992008Z", "dateReserved": "2022-06-30T00:00:00", "dateUpdated": "2024-09-17T04:09:36.869Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vicidial:vicidial:2.14b0.5:3555:*:*:*:*:*:*", "matchCriteriaId": "8F2D723A-5E19-41E1-8E36-D749C6A6C25F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n SQL en la interfaz Agent Time Sheet AST ((/vicidial/AST_agent_time_sheet.php) de VICIdial por medio del par\u00e1metro agent permite al atacante falsificar la identidad, alterar los datos existentes, permitir la divulgaci\u00f3n completa de todos los datos en el sistema, destruir los datos o haga que no est\u00e9 disponible y convi\u00e9rtase en administrador del servidor de la base de datos. Este problema afecta a: VICIdial versiones 2.14b0.5 anteriores a 3555"}], "id": "CVE-2022-34877", "lastModified": "2024-11-21T07:10:21.343", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "cve@rapid7.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-07-05T16:15:08.167", "references": [{"source": "cve@rapid7.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/rapid7/metasploit-framework/pull/16732"}, {"source": "cve@rapid7.com", "tags": ["Vendor Advisory"], "url": "https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/rapid7/metasploit-framework/pull/16732"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af"}], "sourceIdentifier": "cve@rapid7.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "cve@rapid7.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}