CVE-2022-32015

HIGHNuclei

Complete Online Job Search System 1.0 - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-32015 has a selected CVSS score of 7.2 (high); EIP currently links 1 Nuclei template.

Description

Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=category&search=.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryHIGHComplete Online Job Search System 1.0 - SQL InjectionCVSS 7.2

Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/index.php?q=category&search=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.

Impact

Authenticated administrators with high privileges can execute arbitrary SQL queries through the search parameter in the category endpoint, potentially extracting sensitive database information including user credentials, job applications, and employer data.

Remediation

Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Complete Online Job Search System 1.0.

WeaknessesCWE-89
Authorsarafatansari
Template tagscvecve2022sqlijobsearchcomplete_online_job_search_system_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:complete_online_job_search_system_project:complete_online_job_search_system:1.0:*:*:*:*:*:*:*
https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-8.md https://nvd.nist.gov/vuln/detail/CVE-2022-32015 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2