CVE-2024-22196

    Dashboard / Vulnerabilities / CVE-2024-22196

    CVE-2024-22196

    Published: 11 Jan 2024Last Modified: 12 Aug 2026

    Summary: Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

    Details: Nginx-UI is an online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.

    References: https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h374-mm57-879c, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22196.json, https://nvd.nist.gov/vuln/detail/CVE-2024-22196, https://github.com/0xJacky/nginx-ui/commit/ec93ab05a3ecbb6bcf464d9dca48d74452df8a5b

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -daee3ac7ade1162805b3af07807e2f4dc2affaf5

    Affected versions

    v2.0.0-rc.8-patch.1
    v2.0.0-rc.8
    v2.0.0-rc.7-patch.8
    v2.0.0-rc.7-patch.7
    v2.0.0-rc.7-patch.6
    v2.0.0-rc.7-patch.5
    v2.0.0-rc.7-patch.4
    v2.0.0-rc.7-patch.3
    v2.0.0-rc.7-patch.2
    v2.0.0-rc.7
    v2.0.0-rc.6-patch.5
    v2.0.0-rc.6-patch.4
    v2.0.0-rc.6-patch.3
    v2.0.0-rc.6-patch.2
    v2.0.0-rc.6-patch.1
    v2.0.0-rc.6
    v2.0.0-rc.5
    v2.0.0-rc.4-patch.3
    v2.0.0-rc.4-patch.2
    v2.0.0-rc.4-patch.1
    v2.0.0-rc.4
    v2.0.0-rc.3-patch.1
    v2.0.0-rc.3
    v2.0.0-rc.2
    v2.0.0-rc.1-patch.2
    v2.0.0-rc.1-patch.1
    v2.0.0-rc.1
    v2.0.0-beta.42
    v2.0.0-beta.41
    v2.0.0-beta.40
    v2.0.0-beta.39
    v2.0.0-beta.38
    v2.0.0-beta.37-patch.5
    v2.0.0-beta.37-patch.4
    v2.0.0-beta.37-patch.3
    v2.0.0-beta.37-patch.2
    v2.0.0-beta.37-patch.1
    v2.0.0-beta.37
    v2.0.0-beta.36
    v2.0.0-beta.35
    v2.0.0-beta.34
    v2.0.0-beta.33
    v2.0.0-beta.32-patch.1
    v2.0.0-beta.32
    v2.0.0-beta.31
    v2.0.0-beta.30
    v2.0.0-beta.29
    v2.0.0-beta.28
    v2.0.0-beta.27
    v2.0.0-beta.26
    v2.0.0-beta.25-patch.2
    v2.0.0-beta.25-patch.1
    v2.0.0-beta.25
    v2.0.0-beta.24
    v2.0.0-beta.23-patch.2
    v2.0.0-beta.23-patch.1
    v2.0.0-beta.23
    v2.0.0-beta.22
    v2.0.0-beta.21
    v2.0.0-beta.20
    v2.0.0-beta.19
    v2.0.0-beta.18-patch.2
    v2.0.0-beta.18-patch.1
    v2.0.0-beta.18
    v2.0.0-beta.17
    v2.0.0-beta.16
    v2.0.0-beta.15
    v2.0.0-beta.14
    v2.0.0-beta.13-patch
    v2.0.0-beta.13
    v2.0.0-beta.12
    v2.0.0-beta.11
    v2.0.0-beta.10-patch
    v2.0.0-beta.10
    v2.0.0-beta.9
    v2.0.0-beta.8-patch
    v2.0.0-beta.8
    v2.0.0-beta.7
    v2.0.0-beta.6-patch.2
    v2.0.0-beta.6-patch
    v2.0.0-beta.6
    v2.0.0-beta.5-patch
    v2.0.0-beta.5
    v2.0.0-beta.4-patch
    v2.0.0-beta.4
    v2.0.0-beta.3
    v2.0.0-beta.2
    v2.0.0-beta.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-22196 | CVE-DB