SQL Injection in Gym Management System Project
CVE-2022-2708
A vulnerability, which was classified as critical, was found in SourceCodester Gym Management System. This affects an unknown part of the file login.php. The manipulation of the argument user_login with the input 123@xx.com' OR (SELECT 9084 FROM(SELECT COUNT(*),CONCAT(0x7178767871,(SELECT (ELT(9084=9084,1))),0x71767a6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- dPvW leads to sql injection. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-205833 was assigned to this vulnerability.
Vulnerability class: SQL Injection
EPSS: 0.005 (38.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
Weakness classification (CWE)
References
- cna@vuldb.com (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-2708?
- CVE-2022-2708 is a medium-severity vulnerability in Gym Management System Project, classified under SQL Injection. CVSS score: 5.5/10. Published 2022-08-08.
- How severe is CVE-2022-2708?
- Medium severity. CVSS v3 base score is 5.5 out of 10.