CVE-2022-45030

A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secure-file-priv).

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

2.69% chance of exploitation in the next 30 days, 85th percentile

Published

2023-04-15

Updated

2025-02-06

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/171613/rconfig-3.9.7-SQL-Injection.html

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51163

References

• CVE Record
• NVD entry

Related

• CVE-2022-4503
• CVE-2022-45033
• CVE-2022-45028
• CVE-2022-45037
• CVE-2022-45027
• CVE-2022-45038