CVE-2022-4015

A vulnerability, which was classified as critical, was found in Sports Club Management System 119. This affects an unknown part of the file admin/make_payments.php. The manipulation of the argument m_id/plan leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213789 was assigned to this vulnerability.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

4.7 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

EPSS

0.50% chance of exploitation in the next 30 days, 41th percentile

Published

2022-11-16

Updated

2024-08-03

Proof-of-concept exploits (1)

• shreyansh225/Sports-Club-Management-System/issues/6

References

• CVE Record
• NVD entry

Related

• CVE-2022-40146
• CVE-2022-4016
• CVE-2022-4013
• CVE-2022-4017
• CVE-2022-40129
• CVE-2022-4018