CVE-2022-42237

A SQL Injection issue in Merchandise Online Store v.1.0 allows an attacker to log in to the admin account.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 21%
VendorProductVersion
merchandise_online_store_projectmerchandise_online_store
1.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/draco1725/sqlinj/blob/main/poc
https://github.com/draco1725/sqlinj/blob/main/poc