CVE-2026-22196
BaseFortify
Publication date: 2026-01-09
Last updated on: 2026-01-09
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gestsup | gestsup | to 3.2.56 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22196 is a SQL injection vulnerability in GestSup versions up to and including 3.2.56. It occurs in the ticket creation functionality where user input is directly included in SQL queries without proper neutralization. This allows an authenticated attacker to manipulate database queries, potentially leading to unauthorized access or modification of the database depending on the privileges of the database user. [2]
How can this vulnerability impact me? :
This vulnerability can allow an authenticated attacker to manipulate SQL queries in the GestSup application, which may result in unauthorized access to or modification of the database contents. The impact depends on the database privileges but can include data disclosure, data corruption, or disruption of service. [2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this SQL injection vulnerability in GestSup versions up to 3.2.56, you should update GestSup to a version later than 3.2.56 where the vulnerability is fixed. The changelog indicates that security improvements and fixes addressing multiple CVEs, including SQL injection issues, have been implemented in versions 3.2.45 and later. Additionally, ensure that only authenticated users with appropriate privileges can create tickets, and consider applying strict input validation and sanitization on ticket creation inputs as a temporary measure until the update is applied. [1, 2]