SQL Injection Vulnerability in Purchase Order Management System by Oretnom23
CVE-2022-28022

9.8CRITICAL

Key Information:

Vendor

Purchase Order Management System Project

Status
Purchase Order Management System
Vendor
CVE Published:
21 April 2022

What is CVE-2022-28022?

A SQL injection vulnerability exists in the Purchase Order Management System v1.0, specifically through the endpoint /purchase_order/classes/Master.php?f=delete_item. An attacker could exploit this weakness to execute arbitrary SQL commands, potentially compromising the database and retrieving sensitive information.

References

https://github.com/k0xx11/bug_report/blob/main/vendors/or...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.