Insufficient Validation in Digiwin BPM Allows Remote SQL Injection

CVE-2022-32456 · CRITICAL Severity

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Digiwin BPM’s function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify, delete database or disrupt service.

Learn more about our Cis Benchmark Audit For Microsoft Sql Server.