by Kastro
Paper/Archive/CVE-2022-44015

CVE-2022-44015

mitre — An issue was discovered in Simmeth Lieferantenmanager before 5.6.

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
53
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 68.7.687 × 2013.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL server via the xp_cmdshell extended procedure.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refsec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager