CVE-2022-30335

Bonanza Wealth Management System (BWM) 7.3.2 allows SQL injection via the login form. Users who supply the application with a SQL injection payload in the User Name textbox could collect all passwords in encrypted format from the Microsoft SQL Server component.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 52%
VendorProductVersion
wealthbonanza_wealth_management_system
7.3.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://gist.github.com/aliceicl/b2f25f3a0a3ba9973e4977f922d04008
https://incognitolab.com
https://www.wealth.co.th/products/bonanza-wealth-management/
https://gist.github.com/aliceicl/b2f25f3a0a3ba9973e4977f922d04008
https://incognitolab.com
https://www.wealth.co.th/products/bonanza-wealth-management/