A vulnerability classified as critical has been found in Microfinance Management System (Financial Software) (version unknown). Affected is some unknown processing. The manipulation of the argument customer_type_number/account_number/account_status_number/account_type_number with the input value ' and (select * from(select(sleep(10)))Avx) and 'abc' = 'abc leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. An attacker might be able inject and/or alter existing SQL statements which would influence the database exchange.

The weakness was disclosed 03/24/2022. This vulnerability is traded as CVE-2022-1083. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a exploit are known. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 03/29/2022).

It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfoedit

Type

• Financial Software

Name

• Microfinance Management System

CPE 2.3infoedit

• 🔒

CPE 2.2infoedit

• 🔒

CVSSv3infoedit

CVSSv2infoedit

Exploitinginfoedit

Threat Intelligenceinfoedit

Countermeasuresinfoedit

Timelineinfoedit

Sourcesinfoedit

Entryinfoedit

Comments