CVE-2024-22196CWE-89

Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

High · published January 11, 2024

CVSS v3.1
7.0
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

Nginx-UI is an online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00584 · 47.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-01-11T19:24Z
EPSS history
Timeline
  • 11 JAN 19:24Z
    Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)
    cvelistv5