CVE-2022-34878

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SQL Injection vulnerability in User Stats interface (/vicidial/user_stats.php) of VICIdial via the file_download parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
VICIdial	VICIdial	>= 2.14b0.5, < 3555

References

https://github.com/rapid7/metasploit-framework/pull/16732Patch, Third Party Advisory
https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122afVendor Advisory
https://github.com/rapid7/metasploit-framework/pull/16732Patch, Third Party Advisory
https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122afVendor Advisory

Timeline

Published: Jul 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-348796.1Reflected Cross Site Scripting (XSS) vulnerabilities in AST Agent Time Sheet interface (/vicidial/AST_agent_time_sheet.php) of VICIdial via CVE-2022-34887.5Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some w CVE-2022-348813.3Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain sen CVE-2022-348826.5Information Exposure Through an Error Message vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated CVE-2022-348838.8OS Command Injection vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to execute arbitrar CVE-2022-348846.5A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subs CVE-2022-348856.7An improper input sanitization vulnerability in the Motorola MR2600 router could allow a local user with elevated permissions to execute arb CVE-2022-348868.8A remote code execution vulnerability was found in the firmware used in some Lenovo printers, which can be caused by a remote user pushing a CVE-2022-348875.4Standard users can directly operate and set printer configuration information , such as IP, in some Lenovo Printers without having to authen CVE-2022-348884.3The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not norma CVE-2022-348898.2This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 17.1.1 (51537). An attacker CVE-2022-34895.3The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settin