CVE-2026-22196: GestSup < 3.2.60 SQL Injection in Ticket Creation
GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality. User-controlled input provided during ticket creation is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can result in unauthorized access to or modification of database contents depending on database privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22196?
CVE-2026-22196 is considered a high severity vulnerability due to the potential for SQL injection, which can lead to data manipulation or unauthorized access.
How do I fix CVE-2026-22196?
To fix CVE-2026-22196, update GestSup to version 3.2.57 or later, where the SQL injection vulnerability has been resolved.
What software is affected by CVE-2026-22196?
CVE-2026-22196 affects GestSup versions up to and including 3.2.56.
What is the impact of exploiting CVE-2026-22196?
Exploiting CVE-2026-22196 can allow an authenticated attacker to execute arbitrary SQL commands, potentially compromising sensitive data.
How does the SQL injection in CVE-2026-22196 occur?
The SQL injection in CVE-2026-22196 occurs when user input during the ticket creation process is incorporated into SQL queries without proper validation or sanitization.