Vulnerability · Published Jul 18, 2022 · Assigned by mitre

CVE-2022-24690

High 8.2

In plain English

A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).

Severity (CVSS NVD)8.2High

Exploit odds (30 days)1.1%top 33.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A PresAbs.php SQL Injection vulnerability allows unauthenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based. (An unauthenticated attacker can discover the endpoint by abusing a Broken Access Control issue with further SQL injection attacks to gather all user's badge numbers and PIN codes.)

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://dsk.lu/fr/produits/temps-de-presence x_refsource_MISC
https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-24688-92.pdf x_refsource_MISC