CVE-2022-24690

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5

published July 18, 2022

CVSS
—
EPSS
1%
Percentile
66.3
In the wild
Unconfirmed
What it is

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A PresAbs.php SQL Injection vulnerability allows unauthenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based. (An unauthenticated attacker can discover the endpoint by abusing a Broken Access Control issue with further SQL injection attacks to gather all user's badge numbers and PIN codes.)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01139 · 66.3th percentile
Published
2022-07-18T12:34Z
EPSS history
Timeline
  • 18 JUL 12:34Z
    An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5
    cvelistv5