# CVE-2024-22196: 0xJacky Nginx-UI SQL injection in OrderAndPaginate

Source: https://junglewise.ai/threats/cve-2024-22196-0xjacky-nginx-ui-sql-injection-in-orderandpaginate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-11. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2024-22196 · Severity: high · CVSS 7 · Published 2024-01-11

Nginx-UI, a web-based management interface for Nginx, is vulnerable to a security flaw that allows authenticated users to execute unauthorized database queries. By manipulating specific web requests used for sorting and paging data, an attacker could gain access to sensitive information stored in the system's database. This could lead to the exposure of configuration details or other private data managed by the application.

Technologies: [0xJacky Nginx-UI](https://junglewise.ai/threats/technologies/nginx-ui), [github.com/0xJacky/Nginx-UI (Go)](https://junglewise.ai/threats/technologies/github-com-0xjacky-nginx-ui). Vendors: [0xJacky](https://junglewise.ai/threats/vendors/0xjacky), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2024-22196 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-22196 being exploited in the wild.

**How severe is CVE-2024-22196?** High severity, with a CVSS score of 7, published 11 January 2024.

**Which products and versions are affected?** 0xJacky Nginx-UI < 1.9.10-0.20231219195202-ec93ab05a3ec; github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20231219195202-ec93ab05a3ec, SEMVER:introduced=0,fixed=1.9.10-0.20231219195202-ec93ab05a3ec.

**Is there a fix for CVE-2024-22196?** Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20231219195202-ec93ab05a3ec or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-22196 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2024-22196?** Check whether you run 0xJacky Nginx-UI or github.com/0xJacky/Nginx-UI (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20231219195202-ec93ab05a3ec or later

  ```sh
  go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20231219195202-ec93ab05a3ec
  ```


## Technical details

A SQL injection vulnerability exists in Nginx-UI's `OrderAndPaginate` and `SortOrder` functions within `model/model.go`. The application uses `fmt.Sprintf` to construct SQL ORDER BY clauses using the `sort_by` and `order` query parameters without sufficient sanitization or parameterization. An authenticated attacker can exploit this by sending crafted GET requests to endpoints using these functions (such as `/api/dns_credentials`), using CASE statements or other SQL syntax to perform boolean-based or error-based inference of database contents. The vulnerability was addressed in version 1.9.10-0.20231219195202-ec93ab05a3ec.

## Affected products

- 0xJacky Nginx-UI < 1.9.10-0.20231219195202-ec93ab05a3ec

## Identifiers

- CVE-2024-22196
- GHSA-h374-mm57-879c
- GO-2024-2463

## Timeline

- 2024-01-11: disclosed
- 2024-01-11: advisory
- 2023-12-19: patched: Patch committed to repository

## References

- [https://api.github.com/users/jorgectf](https://api.github.com/users/jorgectf)
- [https://github.com/jorgectf](https://github.com/jorgectf)
- [https://api.github.com/users/jorgectf/gists%7B/gist_id%7D](https://api.github.com/users/jorgectf/gists%7B/gist_id%7D)
- [https://api.github.com/users/jorgectf/repos](https://api.github.com/users/jorgectf/repos)
- [https://avatars.githubusercontent.com/u/46056498?v=4](https://avatars.githubusercontent.com/u/46056498?v=4)
- [https://api.github.com/users/jorgectf/events%7B/privacy%7D](https://api.github.com/users/jorgectf/events%7B/privacy%7D)

## Related threats

- [Nginx UI Casdoor SSO login CSRF via constant state parameter](https://junglewise.ai/threats/cve-2026-84312-nginx-ui-casdoor-sso-callback-uses-a-constant-state-parameter)
- [Nginx UI OTP secure-session step-up bypass via MCP](https://junglewise.ai/threats/cve-2026-84360-nginx-ui-otp-secure-session-step-up-can-be-bypassed-via-mcp)
- [Nginx UI short token cache bypass after account re-enable](https://junglewise.ai/threats/cve-2026-84321-nginx-ui-standalone-short-tokens-survive-administrative)
- [Nginx UI auto backup path traversal in storage boundary](https://junglewise.ai/threats/cve-2026-84320-nginx-ui-auto-backup-name-allows-path-traversal-outside-validated)
- [Nginx UI MCP configuration directive validation bypass](https://junglewise.ai/threats/cve-2026-84319-nginx-ui-mcp-configuration-tools-bypass-restricted-directive)