What’s Vulnerable › Vulnerabilities

CVE-2024-22196: Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-11 · updated 2026-06-17
• Weakness: CWE-89

Description

Nginx-UI is an online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.

Affected products

• 0xJacky nginx-ui: before 2.0.0; 2.0.0-beta1, 2.0.0-beta2, 2.0.0-beta3, 2.0.0-beta4, 2.0.0-beta4_patch, 2.0.0-beta5 (+7) — fixed in 2.0.0

How to fix

Upgrade to a fixed version: 0xJacky nginx-ui 2.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/0xJacky/nginx-ui/commit/ec93ab05a3ecbb6bcf464d9dca48d74452df8a5b
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h374-mm57-879c
• https://github.com/0xJacky/nginx-ui/commit/ec93ab05a3ecbb6bcf464d9dca48d74452df8a5b
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h374-mm57-879c

Get alerted when CVE-2024-22196 or the next vulnerability affects your stack