CVE-2022-44290
Published: 02 December 2022
Summary
CVE-2022-44290 is a critical-severity SQL Injection (CWE-89) vulnerability in Webtareas Project Webtareas. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
webTareas version 2.4p5 contains a SQL injection vulnerability in the deleteapprovalstages.php script, where the id parameter is not properly sanitized before being used in database queries. The flaw is tracked as CWE-89 and carries a CVSS 3.1 base score of 9.8, reflecting network attackability, low complexity, and no required authentication or user interaction, with high impact on confidentiality, integrity, and availability.
An unauthenticated attacker with network access can supply a crafted id value to execute arbitrary SQL commands against the underlying database. Successful exploitation can result in data exfiltration, modification or deletion of records, and potential full compromise of the application and its hosted data.
The EPSS score for this CVE has remained at 0.6640 since disclosure, indicating sustained but not newly emerging exploitation interest. No official patch details or mitigation guidance appear in the referenced project site or GitHub issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-47237
Vulnerability details
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.