by Kastro
Paper/Archive/CVE-2022-27927

CVE-2022-27927

mitre — A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database.

EPSS 14%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 96.5.965 × 2019.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database. An attacker can issue SQL commands to the MySQL database through the vulnerable course_code and/or customer_number parameter.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsourcecodester.com/php/14822/microfinance-management-system.htmlrefgithub.com/erengozaydin/Microfinance-Management-System-V1.0-SQL-Injection-Vulnerability-Unauthenticatedrefpacketstormsecurity.com/files/167017/Microfinance-Management-System-1.0-SQL-Injection.html