An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL server via the xp_cmdshell extended procedure.
References
| Link | Resource |
|---|---|
| https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/ | Exploit Third Party Advisory |
| https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/ | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 07:27
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/ - Exploit, Third Party Advisory |
Information
Published : 2022-12-25 05:15
Updated : 2024-11-21 07:27
NVD link : CVE-2022-44015
Mitre link : CVE-2022-44015
CVE.ORG link : CVE-2022-44015
JSON object : View
Products Affected
simmeth
- lieferantenmanager
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')