SQL Injection Vulnerability in PHPOK Product by Qinggan

CVE-2022-51023

What is CVE-2022-51023?

PHPOK versions prior to 5.4.081 are vulnerable to SQL injection, allowing unauthenticated attackers to exploit the system by manipulating ORDER BY clauses through unsanitized input in the sort parameter. This vulnerability can be exploited by sending specially crafted GET requests to the api.php endpoint, which may result in the exposure of sensitive database information through error messages. It was first identified by the Shadowserver Foundation in October 2023, highlighting the urgent need for updates and patches to safeguard against potential attacks.

References