PT-2022-25604 · Unknown · Rickxy Stock Management System

Ace · Published 2022-11-24 · Updated 2022-11-28 · CVE-2022-4088

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions rickxy Stock Management System (affected versions not specified)

Description A critical issue was found in the rickxy Stock Management System, affecting some unknown functionality of the file /pages/processlogin.php. The manipulation of the user/password argument leads to sql injection. The attack can be launched remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the /pages/processlogin.php file to minimize the risk of exploitation. Avoid using the user and password arguments in the affected API endpoint until the issue is resolved.

Exploit

Improper Neutralization

SQL injection

Weakness Enumeration

CWE-707

CWE-89

Related Identifiers

CVE-2022-4088

Affected Products

Rickxy Stock Management System

References · 5

• 🔥 https://github.com/rickxy/Stock-Management-System/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-4088 · Security Note
• https://t.me/cibsecurity/53472 · Telegram Post
• https://t.me/cvenotify/38415 · Telegram Post
• https://vuldb.com/?id.214322 · Note