CVE-2022-45889 - Planet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records stored in the database, and achieve the ability to execute arbitrary SQL commands, via Search (the StatisticsResults.aspx flt parameter)

Back Back to CVE browser

HIGH

Planet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records stored in the database, and achieve the ability to execute arbitrary SQL commands, via Search (the StatisticsResults.aspx flt parameter)

Published Dec 25, 2022

7.2

HIGH

CVSS 3.1

EPSS 1.29%

Description

Planet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records stored in the database, and achieve the ability to execute arbitrary SQL commands, via Search (the StatisticsResults.aspx flt parameter).

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (1)

https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/
ExploitThird Party Advisory

Link	Providers	Tags
https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-planet-enterprises-ltd-planet-estream/		ExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Dec 25, 2022

Updated Apr 14, 2025

Reserved Nov 25, 2022

Link CVE-2022-45889

CISA Vulnrichment

Updated Apr 14, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-45889

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-45889