CVE-2022-24124

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 55.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-01-29 · updated 2026-06-17
Weakness: CWE-89

Description

The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.

Affected products

Casdoor: before 1.13.1 — fixed in 1.13.1

How to fix

Upgrade to a fixed version: Casdoor 1.13.1. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html
https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1
https://github.com/casdoor/casdoor/issues/439
https://github.com/casdoor/casdoor/pull/442
http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html
https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1
https://github.com/casdoor/casdoor/issues/439
https://github.com/casdoor/casdoor/pull/442

Get alerted when CVE-2022-24124 or the next vulnerability affects your stack