{"id":"CVE-2024-22196","aliases":["GHSA-h374-mm57-879c","GO-2024-2463"],"url":"https://o3.security/vulnerability/CVE-2024-22196","summary":"Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)","details":"Nginx-UI is an online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `\"desc\"` and `\"id\"` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.\n\n","published":"2024-01-11T19:24:07.984Z","modified":"2026-07-15T01:48:57.106735876Z","cvss":{"score":7,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Go","name":"github.com/0xJacky/Nginx-UI","fixedVersion":"1.9.10-0.20231219195202-ec93ab05a3ec"}],"fix":{"url":"https://github.com/0xJacky/nginx-ui/commit/ec93ab05a3ecbb6bcf464d9dca48d74452df8a5b","label":"0xJacky/nginx-ui@ec93ab0"},"references":[{"type":"ADVISORY","url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h374-mm57-879c"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22196.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22196"},{"type":"FIX","url":"https://github.com/0xJacky/nginx-ui/commit/ec93ab05a3ecbb6bcf464d9dca48d74452df8a5b"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:48:57.106735876Z"}}