TI-2022-16295 Aliases CVE-2022-35864 GHSA-xmq8-c3h6-wf48

SQL injection in BMC Track-It!

LOW 32CWE-89Published 2022-08-03 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetPopupSubQueryDetails endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-16690.

Why it matters now

EPSS 0.01648 76th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
BMC	Track-It!	20.21.02.109	—	No fix listed	CNA

Track-It! VendorBMC Affected 20.21.02.109 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:a:bmc:track-it\!:20.19.03:::::::*	20.19.03	Vulnerable	BMC
cpe:2.3:a:bmc:track-it\!:20.20.01:::::::*	20.20.01	Vulnerable	BMC
cpe:2.3:a:bmc:track-it\!:20.20.02:::::::*	20.20.02	Vulnerable	BMC
cpe:2.3:a:bmc:track-it\!:20.20.03:::::::*	20.20.03	Vulnerable	BMC
cpe:2.3:a:bmc:track-it\!:20.21.01:::::::*	20.21.01	Vulnerable	BMC
cpe:2.3:a:bmc:track-it\!:20.21.02:::::::*	20.21.02	Vulnerable	BMC

cpe:2.3:a:bmc:track-it\!:20.19.03:*:*:*:*:*:*:* Versions 20.19.03 Vulnerable ·BMC
cpe:2.3:a:bmc:track-it\!:20.20.01:*:*:*:*:*:*:* Versions 20.20.01 Vulnerable ·BMC
cpe:2.3:a:bmc:track-it\!:20.20.02:*:*:*:*:*:*:* Versions 20.20.02 Vulnerable ·BMC
cpe:2.3:a:bmc:track-it\!:20.20.03:*:*:*:*:*:*:* Versions 20.20.03 Vulnerable ·BMC
cpe:2.3:a:bmc:track-it\!:20.21.01:*:*:*:*:*:*:* Versions 20.21.01 Vulnerable ·BMC
cpe:2.3:a:bmc:track-it\!:20.21.02:*:*:*:*:*:*:* Versions 20.21.02 Vulnerable ·BMC

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-35864
2026-10-03 Alias added: GHSA-xmq8-c3h6-wf48

References

Patch 1

https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-It-Version-2

Advisory 1

https://www.zerodayinitiative.com/advisories/ZDI-22-967/

TI-2014-04009 BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows… CVSS 2.0HIGH 7.5
TI-2016-05648 BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage… CVSS 3.0CRITICAL 9.8
TI-2016-05649 BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration… CVSS 3.0CRITICAL 9.8
TI-2022-16296 Missing authentication in BMC Track-It! CVSS 3.1CRITICAL 9.8
TI-2022-08007 Authentication bypass in BMC Track-It! CVSS 3.1CRITICAL 9.8
TI-2021-13989 Unrestricted file upload in BMC Track-It! CVSS 3.1HIGH 8.8

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences