Vulnerability · Published Jul 5, 2022 · Assigned by rapid7

CVE-2022-34878VICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.

Medium 5.5

In plain English

A medium-severity SQL injection in VICIdial from VICIdial. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)3.4%top 11.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Metasploit

Official description

SQL Injection vulnerability in User Stats interface (/vicidial/user_stats.php) of VICIdial via the file_download parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server.

Affected products (as reported)

Vendor	Product	Versions
VICIdial	VICIdial	2.14b0.5 – before 3555

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

References

https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af x_refsource_CONFIRM
https://github.com/rapid7/metasploit-framework/pull/16732 x_refsource_MISC