Read the docs
TI-2024-14789 Aliases CVE-2024-22196GHSA-h374-mm57-879c

Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

Priority MEDIUM 64CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
SQL injection
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Nginx-UI is an online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00584 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nginx-ui (0xJacky): 2.0.0.beta.9github.com/0xJacky/Nginx-UI (Go): 1.9.10-0.20231219195202-ec93ab05a3ec

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
0xJackynginx-uibefore 2.0.0.beta.92.0.0.beta.9Patch availableCNA
—github.com/0xJacky/Nginx-UI (Go)before 1.9.10-0.20231219195202-ec93ab05a3ec1.9.10-0.20231219195202-ec93ab05a3ecPatch availableGHSA-h374-mm57-879c
  • nginx-ui Vendor0xJacky Affected before 2.0.0.beta.9 Fixed in 2.0.0.beta.9 Patch available CNA
  • github.com/0xJacky/Nginx-UI (Go) Vendor— Affected before 1.9.10-0.20231219195202-ec93ab05a3ec Fixed in 1.9.10-0.20231219195202-ec93ab05a3ec Patch available GHSA-h374-mm57-879c

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*before 2.0.0Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta1:*:*:*:*:*:*2.0.0 beta1Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta2:*:*:*:*:*:*2.0.0 beta2Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta3:*:*:*:*:*:*2.0.0 beta3Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4:*:*:*:*:*:*2.0.0 beta4Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4_patch:*:*:*:*:*:*2.0.0 beta4_patchVulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5:*:*:*:*:*:*2.0.0 beta5Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5_patch:*:*:*:*:*:*2.0.0 beta5_patchVulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6:*:*:*:*:*:*2.0.0 beta6Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch:*:*:*:*:*:*2.0.0 beta6_patchVulnerable0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:* Versions before 2.0.0 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta1:*:*:*:*:*:* Versions 2.0.0 beta1 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta2:*:*:*:*:*:* Versions 2.0.0 beta2 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta3:*:*:*:*:*:* Versions 2.0.0 beta3 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4:*:*:*:*:*:* Versions 2.0.0 beta4 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4_patch:*:*:*:*:*:* Versions 2.0.0 beta4_patch Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5:*:*:*:*:*:* Versions 2.0.0 beta5 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5_patch:*:*:*:*:*:* Versions 2.0.0 beta5_patch Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6:*:*:*:*:*:* Versions 2.0.0 beta6 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch:*:*:*:*:*:* Versions 2.0.0 beta6_patch Vulnerable ·0xJacky
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch2:*:*:*:*:*:*2.0.0 beta6_patch2Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta7:*:*:*:*:*:*2.0.0 beta7Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8:*:*:*:*:*:*2.0.0 beta8Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8_patch:*:*:*:*:*:*2.0.0 beta8_patchVulnerable0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch2:*:*:*:*:*:* Versions 2.0.0 beta6_patch2 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta7:*:*:*:*:*:* Versions 2.0.0 beta7 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8:*:*:*:*:*:* Versions 2.0.0 beta8 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8_patch:*:*:*:*:*:* Versions 2.0.0 beta8_patch Vulnerable ·0xJacky

Remediation

  • Fix · CNA nginx-ui (0xJacky) Fixed in 2.0.0.beta.9
  • Fix · GHSA-h374-mm57-879c github.com/0xJacky/Nginx-UI (Go) Fixed in 1.9.10-0.20231219195202-ec93ab05a3ec Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22196
  2. 2026-10-03 Alias added: GHSA-h374-mm57-879c

References

Exploit 1

Patch 1

Advisory 1

Other 4

  • TI-2026-25478 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover CVSS 3.1CRITICAL 9.8
  • TI-2026-25472 nginx-ui Backup Restore Allows Tampering with Encrypted Backups CVSS 4.0CRITICAL 9.4
  • TI-2026-22288 Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure CVSS 3.1CRITICAL 9.8
  • TI-2024-15821 Nginx-UI arbitrary file write through the Import Certificate feature CVSS 3.1CRITICAL 9.8
  • TI-2026-70057 Code injection in Nginx UI backup restore allows code execution CVSS 4.0CRITICAL 9.4
  • TI-2026-32056 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services CVSS 3.1CRITICAL 9.9
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences