Paper/Archive/CVE-2022-2298

CVE-2022-2298

SourceCodester Clinics Patient Management System — SourceCodester Clinics Patient Management System Login Page index.php sql injection

EPSS 1.0%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 61.6.616 × 2012.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability has been found in SourceCodester Clinics Patient Management System 2.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pms/index.php of the component Login Page. The manipulation of the argument user_name with the input admin' or '1'='1 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource

Clinics Patient Management System2.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/CyberThoth/CVE/blob/63e283e7d7dad3783237f15cdae2bb649bc1e198/CVE/Clinic%27s%20Patient%20Management%20System/SQLi/POC.md refvuldb.com/?id.203179