CVE-2022-3973

🗓️ 13 Nov 2022 00:00:00Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 59 Views🌐 WEB

Critical SQL injection vulnerability in Pingkon HMS-PHP /admin/admin.ph

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2022-3973	16 Nov 202207:51	–	circl
CNNVD	HMS-PHP 安全漏洞	13 Nov 202200:00	–	cnnvd
Cvelist	CVE-2022-3973 Pingkon HMS-PHP Data Pump Metadata admin.php sql injection	13 Nov 202200:00	–	cvelist
EUVD	EUVD-2022-43304	3 Oct 202520:07	–	euvd
NVD	CVE-2022-3973	13 Nov 202210:15	–	nvd
Prion	Sql injection	13 Nov 202210:15	–	prion
Positive Technologies	PT-2022-24990 · Unknown · Pingkon Hms-Php	13 Nov 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-3973	6 Feb 202500:44	–	redhatcve
Vulnrichment	CVE-2022-3973 Pingkon HMS-PHP Data Pump Metadata admin.php sql injection	13 Nov 202200:00	–	vulnrichment

NVD

Node

hms-php_project hms-phpMatch-

[
  {
    "vendor": "Pingkon",
    "product": "HMS-PHP",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
github	www.github.com/Pingkon/HMS-PHP/issues/1

Parameter	Position	Path	Description	CWE
uname	request body	/admin/admin.php	SQL injection via manipulated uname and/or pass parameters in admin.php allowing remote attacker to execute arbitrary SQL.	CWE-707
pass	request body	/admin/admin.php	SQL injection via manipulated uname and/or pass parameters in admin.php allowing remote attacker to execute arbitrary SQL.	CWE-707

21 Nov 2024 07:20Current

8.9High risk

Vulners AI Score8.9

CVSS 3.17.3 - 9.8

EPSS0.00298

SSVC

CWE-707