CVE-2022-34877

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. This issue affects: VICIdial 2.14b0.5 versions prior to 3555.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jul 5, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-348788.8SQL Injection vulnerability in User Stats interface (/vicidial/user_stats.php) of VICIdial via the file_download parameter allows attacker tCVE-2022-348796.1Reflected Cross Site Scripting (XSS) vulnerabilities in AST Agent Time Sheet interface (/vicidial/AST_agent_time_sheet.php) of VICIdial via CVE-2022-34887.5Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some wCVE-2022-348813.3Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain senCVE-2022-348826.5Information Exposure Through an Error Message vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated CVE-2022-348838.8OS Command Injection vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to execute arbitrarCVE-2022-348846.5A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subsCVE-2022-348856.7An improper input sanitization vulnerability in the Motorola MR2600 router could allow a local user with elevated permissions to execute arbCVE-2022-348868.8A remote code execution vulnerability was found in the firmware used in some Lenovo printers, which can be caused by a remote user pushing aCVE-2022-348875.4Standard users can directly operate and set printer configuration information , such as IP, in some Lenovo Printers without having to authenCVE-2022-348884.3The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normaCVE-2022-348898.2This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 17.1.1 (51537). An attacker
CVE-2022-34877: High severity, CVSS 8.8 | Vulnix