IdeaLMS 2022 allows SQL injection via the IdeaLMS/ChatRoom/ClassAccessControl/6?isBigBlueButton=0&ClassID= pathname.
References
Link | Resource |
---|---|
https://gist.github.com/RNPG/b154f4b2e90340d2f39605989af06bee | Exploit Third Party Advisory |
https://gist.github.com/This-is-Neo/cc5b08ad8a3a60cd81fd1b9c1cb573b4 | Exploit Third Party Advisory |
Configurations
History
17 Jun 2022, 16:29
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:ideaco:idealms:2022:*:*:*:*:*:*:* | |
First Time |
Ideaco idealms
Ideaco |
|
References | (MISC) https://gist.github.com/RNPG/b154f4b2e90340d2f39605989af06bee - Exploit, Third Party Advisory | |
References | (MISC) https://gist.github.com/This-is-Neo/cc5b08ad8a3a60cd81fd1b9c1cb573b4 - Exploit, Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
CWE | CWE-89 |
10 Jun 2022, 13:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-06-10 13:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-31788
Mitre link : CVE-2022-31788
CVE.ORG link : CVE-2022-31788
JSON object : View
Products Affected
ideaco
- idealms
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')