Vulnerability · Published Jan 4, 2022 · Assigned by GitHub_M
CVE-2022-21644 SQL Injection via search in USOC
Critical 9.1
In plain English
A critical-severity SQL injection in USOC from Aaron-Junker. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Official description
USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via usersearch.php. In search terms provided by the user were not sanitized and were used directly to construct a sql statement. The only users permitted to search are site admins. Users are advised to upgrade as soon as possible. There are not workarounds for this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Aaron-Junker | USOC | < Pb2.4Bfx2 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H