CVE-2022-44014

2022-12-2500:00:00

mitre

www.cve.org

sql injection

data leakage

api design

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.7%

JSON

An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to fetch arbitrary SQL tables. This leaks all user passwords and MSSQL hashes via /DS/LM_API/api/SelectionService/GetPaggedTab.

References

sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/