Main Vulnerability Database Vulnerabilities #VU83454

SQL injection in Social Share Buttons by Supsystic - CVE-2022-33960

Published: November 23, 2023

Vulnerability identifier: #VU83454

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-33960

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Affected software

Social Share Buttons by Supsystic
IBM CICS TX Advanced

How to mitigate CVE-2022-33960

Cybersecurity Help is currently unaware of any official solution to address this vulnerability..

Social Share Buttons by Supsystic - update to 2.2.4
IBM CICS TX Advanced - update to 11.1.0.0 ifix2

External References

Related Security Bulletins