CVE-2022-21644 SQL Injection via search in USOC
USOC CMS allows SQL injection via unsanitized search terms in usersearch.php, enabling admins to manipulate database queries.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-21644?
CVE-2022-21644 is a critical SQL injection vulnerability in Aaron-Junker USOC, published on 4 Jan 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via usersearch.php. In search terms provided by the user were not sanitized and were used directly to construct a sql statement. The only users permitted to search are site admins. Users are advised to upgrade as soon as possible. There are not workarounds for this issue.
Weakness: CWE-89
Which versions are affected by CVE-2022-21644?
It affects 1 product.
Products include Useful Simple Open-Source Cms Project Useful Simple Open-Source Cms.
How do I fix CVE-2022-21644?
No fix has been published for CVE-2022-21644 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-21644 being exploited?
There is no known exploitation of CVE-2022-21644 in the wild and no public exploit code.
Other vulnerabilities in Aaron-Junker USOC
Sources
Also known as GHSA-89jg-6fr3-9q4h.