VULNERABILITY INTELLIGENCE

CVE-2022-44015

CVSS score9.8 CRITICAL
EPSS probability1.22%
CISA KEVNot currently listed
Published2022-12-25
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL server via the xp_cmdshell extended procedure.

Weakness classification

  • nvd@nist.gov: CWE-89
  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-89

Primary references