CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi attacks.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: Fluid Attacks
Published: 2022-11-03T00:00:00
Updated: 2024-08-03T13:10:41.468Z
Reserved: 2022-10-10T00:00:00
Link: CVE-2022-42744
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-11-03T20:15:32.270
Modified: 2024-11-21T07:25:15.137
Link: CVE-2022-42744
Redhat
No data.