CVE-2022-34876

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
VICIdial	VICIdial	>= 2.14b0.5, < 3555

References

https://github.com/rapid7/metasploit-framework/pull/16732Patch, Third Party Advisory
https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122afVendor Advisory
https://github.com/rapid7/metasploit-framework/pull/16732Patch, Third Party Advisory
https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122afVendor Advisory

Timeline

Published: Jul 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-348778.8SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the agent parameter allo CVE-2022-348788.8SQL Injection vulnerability in User Stats interface (/vicidial/user_stats.php) of VICIdial via the file_download parameter allows attacker t CVE-2022-348796.1Reflected Cross Site Scripting (XSS) vulnerabilities in AST Agent Time Sheet interface (/vicidial/AST_agent_time_sheet.php) of VICIdial via CVE-2022-34887.5Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some w CVE-2022-348813.3Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain sen CVE-2022-348826.5Information Exposure Through an Error Message vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated CVE-2022-348838.8OS Command Injection vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to execute arbitrar CVE-2022-348846.5A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subs CVE-2022-348856.7An improper input sanitization vulnerability in the Motorola MR2600 router could allow a local user with elevated permissions to execute arb CVE-2022-348868.8A remote code execution vulnerability was found in the firmware used in some Lenovo printers, which can be caused by a remote user pushing a CVE-2022-348875.4Standard users can directly operate and set printer configuration information , such as IP, in some Lenovo Printers without having to authen CVE-2022-348884.3The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not norma