CVE-2022-24124
HIGH 7.5EPSS 55.3%
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
- CVSS v3.1
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS v3.1
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS v2.0
- 5.0 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N - EPSS
- 55.30% chance of exploitation in the next 30 days, 99th percentile
- Nuclei
- high · CWE-89
- Published
- 2022-01-29
- Updated
- 2024-08-03
Proof-of-concept exploits (11)
- http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html
- casdoor/casdoor/pull/442
- 0xAbbarhSF/CVE-2022-241241★ · 2022-06-04
- 0xStarFord/CVE-2022-241241★ · 2022-06-04
- ColdFusionX/CVE-2022-241248★ · 2022-03-01
- ar2o3/CVE-2022-241241★ · 2022-06-04
- b1gdog/CVE-2022-241242★ · 2023-08-15
- b1gdog/CVE-2022-24124_POC2★ · 2023-08-15
- b1gdog/cve_2022_241242★ · 2023-08-15
- cukw/CVE-2022-24124_POC2★ · 2023-08-15
- abbarhissarh/CVE-2022-24124