CVE-2022-2272

This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the login endpoint. When parsing the username element, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-17331.

• CWE-89

• https://www.zerodayinitiative.com/advisories/ZDI-22-955/Third Party Advisory, VDB Entry
• https://www.zerodayinitiative.com/advisories/ZDI-22-955/Third Party Advisory, VDB Entry

Published

Aug 3, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-22713Windows Hyper-V Denial of Service Vulnerability5.6
• CVE-2022-22715Named Pipe File System Elevation of Privilege Vulnerability7.8
• CVE-2022-22716Microsoft Excel Information Disclosure Vulnerability5.5
• CVE-2022-22717Windows Print Spooler Elevation of Privilege Vulnerability7
• CVE-2022-22718Windows Print Spooler Elevation of Privilege Vulnerability7.8
• CVE-2022-22719A carefully crafted request body can cause a read to a rando…7.5
• CVE-2022-22720Apache HTTP Server 2.4.52 and earlier fails to close inbound…9.8
• CVE-2022-22721If LimitXMLRequestBody is set to allow request bodies larger…9.1
• CVE-2022-22722A CWE-798: Use of Hard-coded Credentials vulnerability exist…7.5
• CVE-2022-22723A CWE-120: Buffer Copy without Checking Size of Input vulner…8.8
• CVE-2022-22724A CWE-400: Uncontrolled Resource Consumption vulnerability e…7.5
• CVE-2022-22725A CWE-120: Buffer Copy without Checking Size of Input vulner…8.8