Vulnerability · Published Jan 3, 2023 · Assigned by twcert
CVE-2022-43437HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - SQL Injection
High 8.8
In plain English
A high-severity SQL injection in EasyTest from HWA JIUH DIGITAL TECHNOLOGY LTD.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.0%top 36.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Download function’s parameter of EasyTest has insufficient validation for user input. A remote attacker authenticated as a general user can inject arbitrary SQL command to access, modify or delete database.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HWA JIUH DIGITAL TECHNOLOGY LTD. | EasyTest | 17L18S |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H