CVE-2022-34877

Deeper analysis

CVE-2022-34877 is a SQL injection vulnerability in the AST Agent Time Sheet interface at /vicidial/AST_agent_time_sheet.php within VICIdial. The flaw is triggered through the agent parameter and affects VICIdial 2.14b0.5 versions prior to build 3555. Successful exploitation can result in identity spoofing, data tampering or destruction, full disclosure of database contents, and administrative control of the underlying database server.

An attacker with low-privileged network access and no user interaction required can supply crafted input to the affected parameter. Because the vulnerability carries a changed scope rating, the attacker can leverage the injection to impact resources beyond the immediate application, achieving the impacts described above.

Public references include Metasploit Framework pull requests that add an exploit module for the issue along with VICIdial community forum threads discussing the flaw. The EPSS score reached a peak of 0.4923 and remains at that level, indicating sustained exploitation interest after disclosure.