CVE-2022-50694

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x SQL Injection via Username Parameter

CVSS 8.8 HIGHEPSS 0.8%CWE-89

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an SQL injection vulnerability in the 'username' POST parameter of index.php that allows attackers to manipulate database queries. Attackers can inject arbitrary SQL code through the username parameter to bypass authentication and potentially access unauthorized database information.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Affected products

Kantar Media · WM2 SOUND4 Ltd. · BigVoice2 SOUND4 Ltd. · BigVoice4 SOUND4 Ltd. · Impact/Pulse Eco SOUND4 Ltd. · Impact/Pulse/First SOUND4 Ltd. · Stream

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/247947 https://packetstormsecurity.com/files/170254/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-username-SQL-Injection.html https://www.sound4.com/https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-sql-injection-via-username-parameter https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5727.php