IBAX go-ibax /api/v2/open/tablesInfo SQL注入

在IBAX go-ibax中已发现了分类为致命的漏洞。 受影响的是未知功能文件：/api/v2/open/tablesInfo。 手动调试的不合法输入可导致 SQL注入。 使用CWE来声明会导致 CWE-89 的问题。 此漏洞的脆弱性 2022-11-01公示人身份2060、所分享。 索取公告的网址是github.com。 该漏洞的交易名称为CVE-2022-3798， 远程可以启动攻击， 有技术细节可用。 此外还有一个漏洞可利用。 该漏洞利用已公开，可能会被利用。 目前漏洞的结构决定了可能的价格范围为美元价USD $0-$5k。 该漏洞由MITRE ATT&CK项目分配为T1505。 它被宣布为proof-of-concept。 该漏洞利用的共享下载地址为：github.com。 估计零日攻击的地下价格约为$0-$5k。 该漏洞被披露后，远在此前发表过可能的缓解措施。

字段2022-11-01 16時43分2022-11-30 15時01分2022-11-30 15時02分
vendorIBAXIBAXIBAX
namego-ibaxgo-ibaxgo-ibax
file/api/v2/open/tablesInfo/api/v2/open/tablesInfo/api/v2/open/tablesInfo
cwe89 (SQL注入)89 (SQL注入)89 (SQL注入)
risk222
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_ePPP
cvss3_vuldb_rcRRR
identifier206020602060
urlhttps://github.com/IBAX-io/go-ibax/issues/2060https://github.com/IBAX-io/go-ibax/issues/2060https://github.com/IBAX-io/go-ibax/issues/2060
availability111
publicity111
urlhttps://github.com/IBAX-io/go-ibax/issues/2060https://github.com/IBAX-io/go-ibax/issues/2060https://github.com/IBAX-io/go-ibax/issues/2060
cveCVE-2022-3798CVE-2022-3798CVE-2022-3798
responsibleVulDBVulDBVulDB
date1667257200 (2022-11-01)1667257200 (2022-11-01)1667257200 (2022-11-01)
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rcURURUR
cvss2_vuldb_auSSS
cvss2_vuldb_rlNDNDND
cvss3_vuldb_prLLL
cvss3_vuldb_rlXXX
cvss2_vuldb_basescore6.56.56.5
cvss2_vuldb_tempscore5.65.65.6
cvss3_vuldb_basescore6.36.36.3
cvss3_vuldb_tempscore5.75.75.7
cvss3_meta_basescore6.36.37.1
cvss3_meta_tempscore5.75.76.9
price_0day$0-$5k$0-$5k$0-$5k
cve_assigned1667257200 (2022-11-01)1667257200 (2022-11-01)
cve_nvd_summaryA vulnerability classified as critical has been found in IBAX go-ibax. Affected is an unknown function of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212634 is the identifier assigned to this vulnerability.A vulnerability classified as critical has been found in IBAX go-ibax. Affected is an unknown function of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212634 is the identifier assigned to this vulnerability.
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prL
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cH
cvss3_nvd_iH
cvss3_nvd_aH
cvss3_cna_avN
cvss3_cna_acL
cvss3_cna_prL
cvss3_cna_uiN
cvss3_cna_sU
cvss3_cna_cL
cvss3_cna_iL
cvss3_cna_aL
cve_cnaVulDB
cvss3_nvd_basescore8.8
cvss3_cna_basescore6.3

◂ 上一步一览下一步 ▸

Do you need the next level of professionalism?

Upgrade your account now!