CVE-2022-50694 | THREATINT

Description

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an SQL injection vulnerability in the 'username' POST parameter of index.php that allows attackers to manipulate database queries. Attackers can inject arbitrary SQL code through the username parameter to bypass authentication and potentially access unauthorized database information.

PUBLISHED Reserved 2025-12-21 | Published 2025-12-30 | Updated 2025-12-30 | Assigner VulnCheck

HIGH: 8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

HIGH: 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Problem types

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Version 2: 1.1/2.15

affected

1.16

affected

1.2

affected

1.30

affected

1.1/2.4.29

affected

1.11

affected

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5727.php (Zero Science Lab Disclosure (ZSL-2022-5727)) third-party-advisory

packetstormsecurity.com/...o-2.x-username-SQL-Injection.html (Packet Storm Security Exploit Details) exploit

exchange.xforce.ibmcloud.com/vulnerabilities/247947 (IBM X-Force Vulnerability Exchange Entry) vdb-entry

www.sound4.com/ (SOUND4 Product Homepage) product

www.vulncheck.com/...-x-sql-injection-via-username-parameter (VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x SQL Injection via Username Parameter) third-party-advisory

cve.org (CVE-2022-50694)

nvd.nist.gov (CVE-2022-50694)

Download JSON