CVE-2022-32964

OMICARD EDM’s API function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to access, modify, delete database or disrupt service.

Score

CVSS 3.1 9.8 Critical

Status

Modified - twcert@cert.org.tw

Published

2022-08-04

Last modified

2024-09-17

Weaknesses

CWE-89

Affected products

• Omicard Edm (Itpison)
• Omicard Edm (Omicard Edm Project)

References

• https://www.chtsecurity.com/news/48032532-b2de-401c-97a8-a2be5691988f
• https://www.twcert.org.tw/tw/cp-132-6372-f61bc-1.html