Vulnerability · Published Jan 14, 2022 · Assigned by twcert
CVE-2022-22055Le-yan Co., Ltd. dental management system - SQL Injection
Critical 9.8
In plain English
A critical-severity SQL injection in Dental Management System from Le-yan Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)2.5%top 15.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Le-yan dental management system contains an SQL-injection vulnerability. An unauthenticated remote attacker can inject SQL commands into the input field of the login page to acquire administrator’s privilege and perform arbitrary operations on the system or disrupt service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Le-yan Co., Ltd. | Dental Management System | 2.8.5 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-5509-80f05-1.html x_refsource_MISC