CVE-2022-32024

HIGHNuclei

Car Rental Management System 1.0 - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-32024 has a selected CVSS score of 7.2 (high); EIP currently links 1 Nuclei template.

Description

Car Rental Management System v1.0 is vulnerable to SQL Injection via car-rental-management-system/booking.php?car_id=.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryHIGHCar Rental Management System 1.0 - SQL InjectionCVSS 7.2

Car Rental Management System 1.0 contains an SQL injection vulnerability via /booking.php?car_id=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or even complete compromise of the system.

Remediation

Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Car Rental Management System 1.0.

WeaknessesCWE-89
Authorsarafatansari
Template tagscvecve2022carrentalcmssqliauthenticatedcar_rental_management_system_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:car_rental_management_system_project:car_rental_management_system:1.0:*:*:*:*:*:*:*
Shodan: http.html:"Car Rental Management System"
Shodan: http.html:"car rental management system"
FOFA: body="car rental management system"
https://github.com/k0xx11/bug_report/blob/main/vendors/campcodes.com/car-rental-management-system/SQLi-4.md https://nvd.nist.gov/vuln/detail/CVE-2022-32024

Source: ProjectDiscovery

References

2