CVE-2022-21644
CRITICALuseful_simple_open-source_cms < pb2.4bfx2 - Authenticated SQL Injection via usersearch.php
Title source: llmDescription
USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via usersearch.php. In search terms provided by the user were not sanitized and were used directly to construct a sql statement. The only users permitted to search are site admins. Users are advised to upgrade as soon as possible. There are not workarounds for this issue.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_confirm
https://github.com/Aaron-Junker/USOC/security/advisories/GHSA-89jg-6fr3-9q4h
Patch, Third Party Advisory x_refsource_misc
https://github.com/Aaron-Junker/USOC/commit/06217c66c8f9b114726b21633eabcd88ac9034aa
Scores
CVSS v3
9.1
EPSS
0.0104
EPSS Percentile
59.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-89
Status
published
Products (1)
useful_simple_open-source_cms_project/useful_simple_open-source_cms
< pb2.4bfx2
Published
Jan 04, 2022
Tracked Since
Feb 18, 2026