CVE-2022-3800
Published: 01 November 2022
Summary
CVE-2022-3800 is a medium-severity Improper Neutralization (CWE-707) vulnerability in Ibax Go-Ibax. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 2.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A critical SQL injection vulnerability exists in the IBAX go-ibax project, specifically in the /api/v2/open/rowsInfo endpoint. The flaw stems from improper handling of the table_name argument, which can be manipulated to inject arbitrary SQL statements. It is tracked as CVE-2022-3800 with a CVSS v3.1 score of 6.3 and is associated with CWE-89 and CWE-707.
An authenticated remote attacker can send crafted requests to the affected API endpoint to execute injected SQL queries. Successful exploitation grants limited read, write, and impact capabilities on the underlying database without requiring user interaction, though the attack requires valid low-privileged credentials.
Public references including the GitHub issue and Vuldb entry confirm that exploit code has been disclosed, but they contain no details on official patches or mitigation steps. The EPSS score has reached a peak of 0.4625 with a current value of 0.3983, indicating sustained but not dramatically escalating exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-7431
Vulnerability details
A vulnerability, which was classified as critical, has been found in IBAX go-ibax. Affected by this issue is some unknown functionality of the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to sql injection. The attack may be launched…
more
remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212636.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.
Enforces use of documented standards and tool configurations that address proper neutralization of inputs/outputs during development.
Validates query inputs to prevent SQL syntax or command manipulation.