CVE-2022-50694highCWE-89

CVE-2022-50694: high-severity vulnerability in Kantar Media WM2

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x SQL Injection via Username Parameter

Published · Updated

Follow this CVE+ Monitor WM2+ Monitor BigVoice2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.9%
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an SQL injection vulnerability in the 'username' POST parameter of index.php that allows attackers to manipulate database queries. Attackers can inject arbitrary SQL code through the username parameter to bypass authentication and potentially access unauthorized database information.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
Kantar Media · WM2SOUND4 Ltd. · BigVoice2SOUND4 Ltd. · BigVoice4SOUND4 Ltd. · Impact/Pulse EcoSOUND4 Ltd. · Impact/Pulse/FirstSOUND4 Ltd. · Stream
Related CVEs — Kantar Media WM2

In the same product, most dangerous first.

CVE-2022-50789HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via dns.phpEPSS 4.2%CVE-2022-50795HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.phpEPSS 4.2%CVE-2022-50791HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via ping.phpEPSS 3.8%CVE-2022-50794CRITICALSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via UsernameEPSS 3.7%CVE-2023-53963CRITICALSOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command InjectionEPSS 3.4%CVE-2022-50793HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Authenticated Command Injection via www-data-handler.phpEPSS 3.1%