{"id":"CVE-2022-0362","published":"2022-01-26T12:40:10Z","modified":"2024-08-02T23:25:40Z","title":"SQL Injection in star7th/showdoc","vendor":"star7th","product":"star7th/showdoc","tier":"tail","description":{"text":"SQL Injection in Packagist showdoc/showdoc prior to 2.10.3.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.7,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01467,"percentile":0.7364,"provenance":"source"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://huntr.dev/bounties/e7c72417-eb8f-416c-8480-be76ac0a9091","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/star7th/showdoc/commit/2b34e267e4186125f99bfa420140634ad45801fb","tags":["x_refsource_MISC"]}],"priority":{"score":19.4,"factors":[{"name":"EPSS percentile","points":14.73},{"name":"CVSS severity","points":4.69}]},"vendorSlug":"star7th","affectedVersions":[{"vendor":"star7th","product":"star7th/showdoc","versions":[">= unspecified, < 2.10.3"]}],"affected":[{"ecosystem":"Packagist","package":"showdoc/showdoc","vulnerableRanges":["<2.10.3"],"patched":["2.10.3"],"from":["GHSA-9cq5-xgg4-x477"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0543","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-star7th-showdoc-cve-2021-4168","parents":[{"from":"CVE-2021-4168","to":"CVE-2022-0362","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/Application/Api/Controller/AdminUserController.class.php"],"commits":["https://github.com/star7th/showdoc/commit/3ff0c85d439ccbdfadeb96b5a52acf6318041109","https://github.com/star7th/showdoc/commit/2b34e267e4186125f99bfa420140634ad45801fb"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2022-0079","published":"2022-01-03","fixed":"2.10.0","kev":false},{"cve":"CVE-2021-4172","published":"2022-01-22","fixed":"2.10.2","kev":false,"link":{"from":"CVE-2021-4172","to":"CVE-2022-0362","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:showdoc/showdoc","fromFixed":"2.10.2","toFixed":"2.10.3","daysApart":4}]}},{"cve":"CVE-2022-0409","published":"2022-02-19","fixed":"2.10.2","kev":false},{"cve":"CVE-2022-0362","published":"2022-01-26","fixed":"2.10.3","kev":false},{"cve":"CVE-2022-0880","published":"2022-03-12","fixed":"2.10.4","kev":false},{"cve":"CVE-2022-0937","published":"2022-03-14","fixed":"2.10.4","kev":false},{"cve":"CVE-2022-0938","published":"2022-03-14","fixed":"2.10.4","kev":false}],"package":"Packagist:showdoc/showdoc"}}