CVE-2022-21644

Katalog CVE

CVSS 7.2 · High EPSS 1,0%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada useful simple open-source cms project useful simple open-source cms. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via usersearch.php. In search terms provided by the user were not sanitized and were used directly to construct a sql statement. The only users permitted to search are site admins. Users are advised to upgrade as soon as possible. There are not workarounds for this issue.

Rincian

Terbit di NVD

4 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 63,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Aaron-Junker/USOC/commit/06217c66c8f9b114726b21633eabcd88ac9034aa patch · advisory pihak ketiga
• https://github.com/Aaron-Junker/USOC/security/advisories/GHSA-89jg-6fr3-9q4h advisory pihak ketiga