CVE-2022-44291
Published: 02 December 2022
Summary
CVE-2022-44291 is a critical-severity SQL Injection (CWE-89) vulnerability in Webtareas Project Webtareas. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
webTareas version 2.4p5 contains a SQL injection vulnerability in phasesets.php that is triggered through the id parameter. The flaw is tracked as CVE-2022-44291, carries a CVSS 3.1 base score of 9.8, and is classified under CWE-89. The affected component is the open-source project-management application webTareas, which exposes the vulnerable endpoint over the network without requiring authentication.
An unauthenticated attacker with network access can supply crafted input to the id parameter and execute arbitrary SQL statements against the backend database. Successful exploitation can result in complete compromise of confidentiality, integrity, and availability, including the ability to read or modify sensitive data and potentially take control of the underlying database server.
The EPSS score for this CVE currently stands at 0.6640, matching its observed peak and indicating sustained exploitation interest since disclosure. No vendor advisory or patch information is provided in the listed references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-47238
Vulnerability details
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.