by Kastro
Paper/Archive/CVE-2022-0944

CVE-2022-0944

sqlpad sqlpad/sqlpad — Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad

EPSS 9%CVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 95.2.952 × 2019.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.

Affected

ProductAffectedFixed inSource
sqlpad/sqlpadunspecified – < 6.10.16.10.1CNA

Scores by source

@huntrdev (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

refhuntr.dev/bounties/46630727-d923-4444-a421-537ecd63e7fbrefgithub.com/sqlpad/sqlpad/commit/3f92be386c6cd3e5eba75d85f0700d3ef54daf73