PT-2022-14156 · Unknown · Home Clean Services Management System

Webraybtl · Published 2022-05-24 · Updated 2022-06-02 · CVE-2022-1838

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Home Clean Services Management System version 1.0

Description A critical issue has been discovered, affecting an unknown part of the admin/login.php component. The manipulation of the username argument with a specific input leads to SQL injection. This issue can be exploited remotely, but authentication is required. Exploit details are publicly available.

Recommendations For Home Clean Services Management System version 1.0, consider temporarily restricting access to the admin/login.php component until a patch is available. Avoid using the username argument in the affected login functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-1838

Affected Products

Home Clean Services Management System

References · 5

• 🔥 https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Home%20Clean%20Services%20Management%20System/HCS_admin_SQL_Inject.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-1838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1838 · Security Note
• https://vuldb.com/?id.200583 · Note
• https://t.me/cibsecurity/43231 · Telegram Post