Vulnerability · Published Oct 31, 2022 · Assigned by twcert
CVE-2022-40742SOFTNEXT TECHNOLOGIES CORP. Mail SQR Expert - Local File Inclusion
Medium 6.5
In plain English
A medium-severity path traversal in Mail SQR Expert from SOFTNEXT TECHNOLOGIES CORP.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.8%top 44.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Mail SQR Expert system has a Local File Inclusion vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SOFTNEXT TECHNOLOGIES CORP. | Mail SQR Expert | 2dut.190301 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N