A vulnerability was found in SourceCodester Microfinance Management System 1.0 (Financial Software). It has been rated as critical. This issue affects an unknown code block of the file /mims/login.php of the component Login Page. The manipulation of the argument username/password with the input value '||1=1# leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. An attacker might be able inject and/or alter existing SQL statements which would influence the database exchange.

The weakness was released 03/24/2022. The identification of this vulnerability is CVE-2022-1082. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a exploit are known. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/29/2022).

It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfoedit

Type

• Financial Software

Vendor

• SourceCodester

Name

• Microfinance Management System

CPE 2.3infoedit

• 🔒

CPE 2.2infoedit

• 🔒

CVSSv3infoedit

CVSSv2infoedit

Exploitinginfoedit

Threat Intelligenceinfoedit

Countermeasuresinfoedit

Timelineinfoedit

Sourcesinfoedit

Entryinfoedit

Comments