Skip to content

Instantly share code, notes, and snippets.

@senzee1984

senzee1984/CVE-2022-36257.md

Created August 31, 2022 23:01
Show Gist options
  • Save senzee1984/ff3816032a76796f45368ed243ab3343 to your computer and use it in GitHub Desktop.
Save senzee1984/ff3816032a76796f45368ed243ab3343 to your computer and use it in GitHub Desktop.
Download ZIP
Public Reference for CVE-2022-36257
Raw
CVE-2022-36257.md

Product: InvetoryManagementSystem

Vendor: https://github.com/sazanrjb

Affected Version(s): 1.0

CVE ID: CVE-2022-36257

Description: A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as "users", "pass", etc.

Vulnerability Type: SQL injection

Root Cause: Multiple methods and their parameters such as changePassword(String user, String pass), getUser(String user), etc. in source file UserDAO.java do not have user input sanitiazation.

Impact: An attacker is able to extract sensitive data from the database.

PoC:

  1. Set value of parameter "user" as '--.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment