CVE-2022-4375
Published: 09 December 2022
Summary
CVE-2022-4375 is a medium-severity Improper Neutralization (CWE-707) vulnerability in Mingsoft Mcms. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 3.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-4375 is a SQL injection vulnerability affecting Mingsoft MCMS versions up to 5.2.9. It exists in an unknown function within the /cms/category/list file, where unsanitized input to the sqlWhere parameter permits injection of arbitrary SQL statements. The issue carries a CVSS 3.1 base score of 6.3 and is tracked under CWE-89 and CWE-707.
An authenticated remote attacker with low privileges can supply crafted SQL via the vulnerable parameter to read, modify, or delete database contents. Public exploit code has been disclosed, enabling straightforward remote execution without user interaction.
Advisories and the vendor issue tracker recommend upgrading to MCMS 5.2.10 to resolve the flaw, noting that the patch eliminates the injection vector in the affected endpoint.
The associated EPSS score rose from a low baseline to a peak of 0.3968 before settling at the current value of 0.2623, indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-7645
Vulnerability details
A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch…
more
the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.
Enforces use of documented standards and tool configurations that address proper neutralization of inputs/outputs during development.
Validates query inputs to prevent SQL syntax or command manipulation.