by Kastro
Paper/Archive/CVE-2022-32964

CVE-2022-32964

ITPison OMICARD EDM — ITPison OMICARD EDM - SQL Injection

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 73.4.734 × 2014.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

OMICARD EDM’s API function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to access, modify, delete database or disrupt service.

Affected

ProductAffectedFixed inSource
OMICARD EDM5.8 – 6.0–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftwcert.org.tw/tw/cp-132-6372-f61bc-1.htmlrefchtsecurity.com/news/48032532-b2de-401c-97a8-a2be5691988f