CVE-2022-45889

Planet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records stored in the database, and achieve the ability to execute arbitrary SQL commands, via Search (the StatisticsResults.aspx flt parameter).

Score

CVSS 3.1 7.2 High

Status

Modified - cve@mitre.org

Published

2022-12-25

Last modified

2025-04-14

Weaknesses

CWE-89

Affected products

• Planet Estream (Planetestream)

References

• https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-e…