CVE-2024-22196

Katalog CVE

CVSS 6.5 · Medium EPSS 0,58%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada nginxui nginx ui. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Nginx-UI is an online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.

Rincian

Terbit di NVD

11 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h374-mm57-879c exploit · advisory vendor
• https://github.com/0xJacky/nginx-ui/commit/ec93ab05a3ecbb6bcf464d9dca48d74452df8a5b patch