PT-2022-25246 · Unknown · Sports Club Management System

Ace · Published 2022-11-16 · Updated 2023-12-28 · CVE-2022-4015

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sports Club Management System version 119

Description A critical issue was found in the Sports Club Management System, affecting the file admin/make payments.php. The manipulation of the m id/plan argument leads to SQL injection. It is possible to initiate the attack remotely. The issue has been publicly disclosed and may be exploited.

Recommendations For Sports Club Management System version 119, consider disabling access to the admin/make payments.php file until a patch is available. Restrict the manipulation of the m id/plan argument to minimize the risk of SQL injection. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Improper Neutralization

SQL injection

Weakness Enumeration

CWE-707

CWE-89

Related Identifiers

CVE-2022-4015

Affected Products

Sports Club Management System

References · 5

• 🔥 https://github.com/shreyansh225/Sports-Club-Management-System/issues/6 · Exploit
• https://osv.dev/vulnerability/CVE-2022-4015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4015 · Security Note
• https://vuldb.com/?id.213789 · Note
• https://t.me/cvenotify/37862 · Telegram Post