Critical severity · published Feb 8, 2023
CVE-2022-45526
SQL Injection vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows attackers to execute arbitrary commands via the ad parameter to…
9.8
CVSS
1.8%
EPSS
No
On KEV
Description
SQL Injection vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows attackers to execute arbitrary commands via the ad parameter to /admin_area/login_transfer.php.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Affected product
IM
Institutional Management Website
Institutional Management Website Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-45526
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-45526
Exploit
https://github.com/Future-Depth/IMS/issues/1
More from Institutional Management Website
9.8
CVE-2022-45527
File upload vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows unauthorized attackers to directly upload malicious files to the courseimg directory