CVE-2022-24240
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
ACEweb Online Portal 3.5.065 was found to have a SQL injection vulnerability via the 'criteria' parameter in showschedule.awp. An attacker can manipulate database queries, potentially leading to unauthorized data access.
Risk Assessment
The risk includes potential leakage of sensitive data, modification or deletion of database records, and possible privilege escalation within the system.
Recommendation
Immediately update ACEweb Online Portal to the latest version and implement parameterized SQL queries or prepared statements in the application code.
Other vulnerabilities in ACEweb Online Portal
See all- CVE-2022-24239Critical
ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp. This allows an attacker to upload arbitrary files to the server.
- CVE-2022-24581High
A vulnerability in ACEweb Online Portal 3.5.065 allows an unauthenticated attacker to capture SMB hashes by specifying an external UNC path when uploading a file. The attacker can trick the victim server into disclosing the username and password hash of the user running the ACEweb Online software.
- CVE-2022-24241High
ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp.
- CVE-2022-24238Medium
ACEweb Online Portal 3.5.065 was found to have a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp. An attacker can inject malicious JavaScript code that executes in the victim's browser.
Original NVD description (English source)
ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp.