CVE-2022-25488

CRITICALNuclei

thedigitalcraft atomcms Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2022-25488 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 8, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

atomcms

Browse thedigitalcraft / atomcms
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALAtom CMS v2.0 - SQL InjectionCVSS 9.8

Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Fixed in version Atom CMS v2.1

WeaknessesCWE-89
Authorstheamanrawat
Template tagscvecve2022sqliatomcmsthedigitalcraftvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:thedigitalcraft:atomcms:2.0:*:*:*:*:*:*:*
https://github.com/thedigicraft/Atom.CMS/issues/257 https://nvd.nist.gov/vuln/detail/CVE-2022-25488 https://github.com/ARPSyndicate/cvemon https://github.com/superlink996/chunqiuyunjingbachang

Source: ProjectDiscovery

References

2