CVE-2022-4889

Medium

Description

A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file doc_root/public_html/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is 63e1b040373ee5b6c7d1e165ecf5ae1603d29e0a. It is recommended to apply a patch to fix this issue. The identifier VDB-218377 was assigned to this vulnerability.

SeverityMedium

CVSS5.5

Exploit probability—

ProductStracker

PublishedJan 15, 2023

First seenJan 15, 2023

Weakness typeCWE-89SQL injection

How to fix

Update

stracker_project stracker2022-04-09 or later

Patches

github.com/visegripped/stracker/commit/63e1b040373ee5b6c7d1e165ecf5ae1603d29e0a

Affected products

Product	Affected versions	Fixed in
stracker_project stracker	v < 2022-04-09	2022-04-09

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.