CVE-2022-1531

SQL injection vulnerability in ARAX-UI Synonym Lookup functionality in rtxteam/rtx

State: Published
Severity: 10.0 Critical
Published: Apr 29, 2022
Updated: Aug 3, 2024
Reserved: Apr 29, 2022

Description

SQL injection vulnerability in ARAX-UI Synonym Lookup functionality in GitHub repository rtxteam/rtx prior to checkpoint_2022-04-20 . This vulnerability is critical as it can lead to remote code execution and thus complete server takeover.

Scores

CVSS	Score	Vector	Source
3.0	10.0 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	@huntrdev

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command

Affected Products

Product	Versions
rtxteam/rtxrtxteam	before checkpoint_2022-04-20Affected

References

https://huntr.dev/bounties/fc4eb544-ef1e-412d-9fdb-0ceb04e038fe
https://github.com/rtxteam/rtx/commit/fa2797e656e3dba18f990a2db1f0f029d41f1921

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.