CVE-2022-39066 SQL injection in MF286R
An authenticated attacker can execute arbitrary SQL commands via the phonebook interface in the ZTE MF286R router.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-39066?
CVE-2022-39066 is a high-severity SQL injection vulnerability in MF286R, published on 22 Nov 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection.
Weakness: CWE-89
Which versions are affected by CVE-2022-39066?
It affects 1 product.
Products include Zte Mf286r Firmware.
How do I fix CVE-2022-39066?
No fix has been published for CVE-2022-39066 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-39066 being exploited?
There is no known exploitation of CVE-2022-39066 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in MF286R
- CVE-2022-39073 Command injection in MF286R
- CVE-2023-25649 OS Command Injection Vulnerability in a Mobile Internet Product of ZTE
- CVE-2022-39067 Memory corruption in MF286R
- CVE-2022-39072 Cross-site scripting in MF286R,MF289D
- CVE-2023-25651 SQL Injection Vulnerability in Some ZTE Mobile Internet Products
Sources
Also known as GHSA-2m5w-88gg-379g.