{"api_version":"1","generated_at":"2026-07-23T13:01:56+00:00","cve":"CVE-2022-40742","urls":{"html":"https://cve.report/CVE-2022-40742","api":"https://cve.report/api/cve/CVE-2022-40742.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-40742","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-40742"},"summary":{"title":"CVE-2022-40742","description":"Mail SQR Expert system has a Local File Inclusion vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability.","state":"PUBLIC","assigner":"cve@cert.org.tw","published_at":"2022-10-31 07:15:00","updated_at":"2022-11-01 15:14:00"},"problem_types":["CWE-22"],"metrics":[],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-6644-d7aac-1.html","name":"https://www.twcert.org.tw/tw/cp-132-6644-d7aac-1.html","refsource":"MISC","tags":[],"title":"TWCERT/CC台灣電腦網路危機處理暨協調中心|企業資安通報協處|資安情資分享|漏洞通報|資安聯盟|資安電子報-中華數位科技 Mail SQR Expert 全方位電子郵件管理專家 - Local File Inclusion","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40742","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40742","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"40742","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"softnext","cpe5":"mail_sqr_expert","cpe6":"2dut.220701","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"AKA":"TWCERT/CC","ASSIGNER":"cve@cert.org.tw","DATE_PUBLIC":"2022-10-31T06:24:00.000Z","ID":"CVE-2022-40742","STATE":"PUBLIC","TITLE":"SOFTNEXT TECHNOLOGIES CORP. Mail SQR Expert - Local File Inclusion"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Mail SQR Expert","version":{"version_data":[{"version_affected":"=","version_value":"2dut.190301"}]}}]},"vendor_name":"SOFTNEXT TECHNOLOGIES CORP."}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Mail SQR Expert system has a Local File Inclusion vulnerability. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary PHP file with .asp file extension under specific system paths, to access and modify partial system information but does not affect service availability."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-noinfo"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://www.twcert.org.tw/tw/cp-132-6644-d7aac-1.html","name":"https://www.twcert.org.tw/tw/cp-132-6644-d7aac-1.html"}]},"solution":[{"lang":"eng","value":"Update Mail SQR Expert version to 2dut.220701 (The version except FreeBSD 9.x device)"}],"source":{"advisory":"TVN-202210009","discovery":"EXTERNAL"}},"nvd":{"publishedDate":"2022-10-31 07:15:00","lastModifiedDate":"2022-11-01 15:14:00","problem_types":["CWE-22"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":3.9,"impactScore":2.5}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:softnext:mail_sqr_expert:2dut.220701:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}