VulnerabilityModified
CVE-2022-27927
A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database.
CRITICAL 9.8EPSS 13.8%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 13.8%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database. An attacker can issue SQL commands to the MySQL database through the vulnerable course_code and/or customer_number parameter.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 13.83% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- microfinance management system project/microfinance management system
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/167017/Microfinance-Management-System-1.0-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
- https://github.com/erengozaydin/Microfinance-Management-System-V1.0-SQL-Injection-Vulnerability-UnauthenticatedExploit, Third Party Advisory
- https://www.sourcecodester.com/php/14822/microfinance-management-system.htmlProduct, Third Party Advisory
- http://packetstormsecurity.com/files/167017/Microfinance-Management-System-1.0-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
- https://github.com/erengozaydin/Microfinance-Management-System-V1.0-SQL-Injection-Vulnerability-UnauthenticatedExploit, Third Party Advisory
- https://www.sourcecodester.com/php/14822/microfinance-management-system.htmlProduct, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.