by Kastro
Paper/Archive/CVE-2022-40741

CVE-2022-40741

SOFTNEXT TECHNOLOGIES CORP. Mail SQR Expert — SOFTNEXT TECHNOLOGIES CORP. Mail SQR Expert - Command Injection

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 70.4.704 × 2014.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Mail SQR Expert’s specific function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vulnerability to perform arbitrary system command and disrupt service.

Affected

ProductAffectedFixed inSource
Mail SQR Expert2dut.190301–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reftwcert.org.tw/tw/cp-132-6643-89bfa-1.html