← Database

CVE-2022-25225

HIGH CVSS: 7.2 Published: 2022-03-10 Modified: 2026-06-17

Description

Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation (PostgreSQL) by exploiting this issue.

Affected Platforms

Softinventive Network Olympus

Weakness Type

CWE-89

References