CVE-2022-38867

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-38867
SQL Injection vulnerability in rttys versions 4.0.0, 4.0.1, 4.0.2, and 4.4.x in api.go, allows attackers to execute arbitrary code.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/zhaojh329/rttys/blob/v4.4.1/api.go#L295
https://github.com/zhaojh329/rttys/issues/117 Exploit Issue Tracking Vendor Advisory
https://github.com/zhaojh329/rttys/issues/117 Exploit Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:rttys_project:rttys:*:*:*:*:*:*:*:*
History

01 Apr 2025, 17:15

Type Values Removed Values Added
Summary (en) SQL Injection vulnerability in rttys versions 4.0.0, 4.0.1, and 4.0.2 in api.go, allows attackers to execute arbitrary code. (en) SQL Injection vulnerability in rttys versions 4.0.0, 4.0.1, 4.0.2, and 4.4.x in api.go, allows attackers to execute arbitrary code.
References
  • () https://github.com/zhaojh329/rttys/blob/v4.4.1/api.go#L295 -

21 Nov 2024, 07:17

Type Values Removed Values Added
References () https://github.com/zhaojh329/rttys/issues/117 - Exploit, Issue Tracking, Vendor Advisory () https://github.com/zhaojh329/rttys/issues/117 - Exploit, Issue Tracking, Vendor Advisory
Information

Published : 2023-02-15 22:15

Updated : 2025-04-01 17:15

NVD link : CVE-2022-38867

Mitre link : CVE-2022-38867

CVE.ORG link : CVE-2022-38867

JSON object : View

Products Affected

rttys_project

  • rttys
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')