PT-2022-20134
CVE-2022-30469
·
Published
2022-06-06
·
Updated
2022-06-14
Description by
CVSS 3.1
8.8
HighMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Afian Filerun version 20220202
Description
The issue is related to a lack of sanitization of the POST parameter
metadata[] in the /module=fileman§ion=get&page=grid endpoint, which leads to SQL injection.Recommendations
For Afian Filerun version 20220202, consider disabling the
/?module=fileman§ion=get&page=grid endpoint until a patch is available to prevent SQL injection attacks. Restrict access to the metadata[] parameter in the affected endpoint to minimize the risk of exploitation. Found an issue in the description? Have something to add? Feel free to write us 👾