Not rated
CVE-2022-25228 CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via…
Description
CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameter, in '/index.php?m=candidates&a=show' via the 'candidateID', in '/index.php?m=joborders&a=show' via the 'jobOrderID' and '/index.php?m=companies&a=show' via the 'companyID' parameter
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| CandidATS | Versions not published |
Other CVEs of CandidATS
The 9 CVEs of CandidATS →
CVE-2022-42744
CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases
9.8
Critical
CVE-2022-42751
CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application
8.8
High
CVE-2022-42745
CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server
Not rated
CVE-2022-42746
CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of…
6.1
Medium