Non notée
CVE-2022-25228 CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via…
Description
CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameter, in '/index.php?m=candidates&a=show' via the 'candidateID', in '/index.php?m=joborders&a=show' via the 'jobOrderID' and '/index.php?m=companies&a=show' via the 'companyID' parameter
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| CandidATS | Versions non publiées |
Références
- fluidattacks.com fluidattacks.com
- candidats.net candidats.net
Chronologie
- Publiée
- Dernière modification
Autres CVE de CandidATS
Les 9 CVE de CandidATS →
CVE-2022-42744
CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases
9.8
Critique
CVE-2022-42751
CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application
8.8
Élevée
CVE-2022-42745
CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server
Non notée
CVE-2022-42746
CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of…
6.1
Moyenne