CVE-2022-4984: ZenTao Biz < 6.5, Max < 3.0, & Open Source Edition 16.5/16.5beta1 SQL Injection via user-login.html
ZenTao Biz < 6.5, ZenTao Max < 3.0, ZenTao Open Source Edition < 16.5, and ZenTao Open Source Edition < 16.5.beta1 contain an SQL injection vulnerability in the login functionality. The application does not properly validate the account parameter on /zentao/user-login.html before using it in a database query. A remote unauthenticated attacker can exploit this issue to execute crafted SQL expressions and retrieve sensitive information from the backend database, including user and application data. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-07 UTC.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-4984?
CVE-2022-4984 is considered a high severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2022-4984?
To fix CVE-2022-4984, upgrade ZenTao Biz to version 6.5, ZenTao Max to version 3.0, or ZenTao Open Source Edition to version 16.5 or above.
Which software is affected by CVE-2022-4984?
CVE-2022-4984 affects ZenTao Biz versions below 6.5, ZenTao Max versions below 3.0, and ZenTao Open Source Edition versions below 16.5 and 16.5.beta1.
What type of vulnerability is CVE-2022-4984?
CVE-2022-4984 is classified as an SQL injection vulnerability specifically within the login functionality of the affected applications.
What is the impact of exploiting CVE-2022-4984?
Exploiting CVE-2022-4984 could allow an attacker to execute arbitrary SQL commands, potentially compromising user data and application integrity.