CVE-2022-42744

CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi attacks.

Score

CVSS 3.1 9.8 Critical

Status

Modified - help@fluidattacks.com

Published

2022-11-03

Last modified

2025-05-05

Weaknesses

CWE-89

Affected products

• Candidats (Auieo)

References

• https://candidats.net/
• https://fluidattacks.com/advisories/mohawke/