SourceCodester Loan Management System login.php username sql injection

EntryHistoryDiffjsonxmlCTI

A vulnerability has been found in SourceCodester Loan Management System and classified as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username leads to sql injection. Using CWE to declare the problem leads to CWE-89. The weakness was presented 08/05/2022. The advisory is available at github.com. This vulnerability was named CVE-2022-2666. The attack can be initiated remotely. Technical details are available. Furthermore, there is an exploit available. The exploit has been disclosed to the public and may be used. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment. This vulnerability is assigned to T1505 by the MITRE ATT&CK project. It is declared as proof-of-concept. It is possible to download the exploit at github.com. As 0-day the estimated underground price was around $0-$5k. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

1	22

Field

source_cve_assigned	1
exploit_price_0day	1
vulnerability_cvss3_meta_tempscore	1
vulnerability_cvss3_meta_basescore	1
vulnerability_cvss3_vuldb_tempscore	1

Commit Conf

90%	29
50%	11
70%	1

Approve Conf

90%	29
80%	11
70%	1

ID	Commited	User	Field	Change	Remarks	Accepted	Status	C
12921612	08/30/2022	VulD...	cve_assigned	1659650400 (08/05/2022)	cve.mitre.org	08/30/2022	accepted	70
12820191	08/05/2022	VulD...	price_0day	$0-$5k	see exploit price documentation	08/05/2022	accepted	90
12820190	08/05/2022	VulD...	cvss3_meta_tempscore	5.7	see CVSS documentation	08/05/2022	accepted	90
12820189	08/05/2022	VulD...	cvss3_meta_basescore	6.3	see CVSS documentation	08/05/2022	accepted	90
12820188	08/05/2022	VulD...	cvss3_vuldb_tempscore	5.7	see CVSS documentation	08/05/2022	accepted	90
12820187	08/05/2022	VulD...	cvss3_vuldb_basescore	6.3	see CVSS documentation	08/05/2022	accepted	90
12820186	08/05/2022	VulD...	cvss2_vuldb_tempscore	5.6	see CVSS documentation	08/05/2022	accepted	90
12820185	08/05/2022	VulD...	cvss2_vuldb_basescore	6.5	see CVSS documentation	08/05/2022	accepted	90
12820184	08/05/2022	VulD...	cvss3_vuldb_rl	X	derived from historical data	08/05/2022	accepted	80
12820183	08/05/2022	VulD...	cvss3_vuldb_pr	L	derived from historical data	08/05/2022	accepted	80
12820182	08/05/2022	VulD...	cvss2_vuldb_rl	ND	derived from historical data	08/05/2022	accepted	80
12820181	08/05/2022	VulD...	cvss2_vuldb_au	S	derived from historical data	08/05/2022	accepted	80
12820180	08/05/2022	VulD...	cvss2_vuldb_rc	UR	derived from vuldb v3 vector	08/05/2022	accepted	80
12820179	08/05/2022	VulD...	cvss2_vuldb_e	POC	derived from vuldb v3 vector	08/05/2022	accepted	80
12820178	08/05/2022	VulD...	cvss2_vuldb_ai	P	derived from vuldb v3 vector	08/05/2022	accepted	80
12820177	08/05/2022	VulD...	cvss2_vuldb_ii	P	derived from vuldb v3 vector	08/05/2022	accepted	80
12820176	08/05/2022	VulD...	cvss2_vuldb_ci	P	derived from vuldb v3 vector	08/05/2022	accepted	80
12820175	08/05/2022	VulD...	cvss2_vuldb_ac	L	derived from vuldb v3 vector	08/05/2022	accepted	80
12820174	08/05/2022	VulD...	cvss2_vuldb_av	N	derived from vuldb v3 vector	08/05/2022	accepted	80
12820173	08/05/2022	VulD...	date	1659650400 (08/05/2022)		08/05/2022	accepted	90

21 more entries are not shown

🔒 Login Required

You need to signup and login to see more of the remaining 21 results.

◂ Previous Overview Next ▸

Do you need the next level of professionalism?

Upgrade your account now!