Wukong Crm
CVE-2022-37178
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
An issue was discovered in 72crm 9.0. There is a SQL Injection vulnerability in View the task calendar.
AnalysisAI
An issue was discovered in 72crm 9.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. An issue was discovered in 72crm 9.0. There is a SQL Injection vulnerability in View the task calendar. Affected products include: 72Crm Wukong Crm.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.
More in Wukong Crm
View all72crm 9.0 has an Arbitrary file upload vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Unauthenticated fastjson deserialization in WukongCRM 9.0 (Java edition) via the /OaExamine/setOaExamine HTTP endpoint a
Cross-site request forgery in WuKongOpenSource WukongCRM 9.0 allows an attacker to perform unauthorized actions on behal
Stored cross-site scripting in WukongCRM 9.0 allows authenticated attackers to inject arbitrary web scripts via the file
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today