CVE-2022-4375

Mingsoft MCMS list sql injection

A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196.

Affected

Mingsoft · MCMS

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 VULDB

6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS

3.15% chance of exploitation in the next 30 days, 88th percentile

Nuclei

critical

Published

2022-12-09

Updated

2025-04-15

Proof-of-concept exploits (2)

• https://gitee.com/mingSoft/MCMS/issues/I61TG5
• https://vuldb.com/?id.215196

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4375.yaml

Security advisories

• advisories/GHSA-hc5g-xf64-j49j

References

• CVE Record
• NVD entry