SQL Injection Vulnerability in Janobe's Online Ordering System
CVE-2022-31337

9.8CRITICAL

Key Information:

Vendor: Online Ordering System Project
Status: Online Ordering System
Vendor: CVE Published:; 31 May 2022

🔔 Create Online Ordering System Project Vulnerability Alert

What is CVE-2022-31337?

The Online Ordering System version 2.3.2, developed by Janobe, is susceptible to SQL Injection through a specific parameter in its admin interface. Attackers can exploit this vulnerability via the '/ordering/admin/category/index.php?view=edit&id=' endpoint, allowing unauthorized access to the database. This could lead to data leakage, manipulation of user inputs, and potential compromise of sensitive information. It is crucial for users of this software to apply necessary security patches and implement best practices to safeguard their applications against such vulnerabilities.

References

https://github.com/k0xx11/bug_report/blob/main/vendors/ja...

x_refsource_MISC

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 31, 2022
Vulnerability Reserved
May 23, 2022

CVE-2022-31337 Data

JSON