PT-2022-19947 · Unknown · Online Sports Complex Booking System

K0Xx11 · Published 2022-05-12 · Updated 2022-05-19 · CVE-2022-29985

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Online Sports Complex Booking System version 1.0

Description The issue concerns a SQL Injection vulnerability. It can be exploited via the Master.php file, specifically through the delete category function. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the API endpoint /scbs/classes/Master.php?f=delete category.

Recommendations For Online Sports Complex Booking System version 1.0, consider restricting access to the delete category function in the Master.php file until a patch is available. Avoid using the f parameter in the affected API endpoint /scbs/classes/Master.php?f=delete category to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-29985

Affected Products

Online Sports Complex Booking System

References · 4

• 🔥 https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Online-Sports-Complex-Booking-System/SQLi-1.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-29985 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29985 · Security Note
• https://t.me/cibsecurity/42486 · Telegram Post