CVE-2022-25775: SQL Injection in dynamic Reports
Impact Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle.
The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems.
Patches Update to 4.4.12 or 5.0.4
Workarounds No
References - https://owasp.org/www-community/attacks/SQLInjection - https://owasp.org/www-community/attacks/BlindSQLInjection
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25775?
CVE-2022-25775 has a medium severity rating due to its potential impact on sensitive data and system integrity.
How do I fix CVE-2022-25775?
To fix CVE-2022-25775, update Mautic to version 5.0.4 or 4.4.12 or later.
What type of vulnerability is CVE-2022-25775?
CVE-2022-25775 is an SQL injection vulnerability affecting the Reports bundle in Mautic.
Who is affected by CVE-2022-25775?
Users of Mautic versions prior to 5.0.4 and 4.4.12 are affected by CVE-2022-25775.
What could an attacker do with CVE-2022-25775?
An attacker exploiting CVE-2022-25775 could potentially retrieve and alter sensitive data and manipulate file systems.