CVE-2022-25506 SQL Injection in FreeTAKServer-UI
Attackers can exploit SQL injection in the authentication API to read or modify database contents in FreeTAKServer-UI.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-25506?
CVE-2022-25506 is a medium-severity SQL injection vulnerability in n/a, published on 10 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.
Weakness: CWE-89
Which versions are affected by CVE-2022-25506?
3 open source packages ship an affected version, including freetakserver-ui and FreeTAKServer-UI. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
freetakserver-ui PyPI | All versions to 1.9.8 | None |
freetakserver-ui PyPI | All versions to 1.9.8 | None |
FreeTAKServer-UI PyPI | All versions to 1.9.8 | None |
Products include Freetakserver-Ui Project Freetakserver-Ui.
How do I fix CVE-2022-25506?
No fix has been published for CVE-2022-25506 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-25506 being exploited?
There is no known exploitation of CVE-2022-25506 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-25510 Hard coded credentials in FreeTAKServer
- CVE-2022-25508 Improper Authentication in FreeTAKServer
- CVE-2022-25512 Exposure of Sensitive Information to an Unauthorized Actor in FreeTAKServer-UI
- CVE-2022-25511 Path traversal in FreeTAKServer-UI
- CVE-2022-25507 Cross-site Scripting in FreeTAKServer-UI
Sources
Also known as GHSA-jr2m-29wj-w9qc, PYSEC-2026-640.