CVE-2022-37773
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter, allows the complete disclosure of all databases.
Risk Assessment
An authenticated attacker can read the entire database contents, leading to exposure of sensitive organizational data.
Recommendation
Immediately update Maarch RM to the latest version and implement parameterized SQL queries for the filter parameter.
Other vulnerabilities in Maarch RM
See all- CVE-2022-37772High
The vulnerability in Maarch RM 2.8.3 is due to improper restriction of excessive authentication attempts, manifested by overly verbose responses from the application. An unauthenticated remote attacker could exploit this flaw to perform brute-force attacks on user accounts.
- CVE-2022-37774Medium
A broken access control vulnerability was found in Maarch RM 2.8.3. When previewing documents (PDF, email) from an archive, the application generates a URL containing an MD5 hash of the file, which is accessible without authentication.
Original NVD description (English source)
An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter, allows the complete disclosure of all databases.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS