CVE-2022-3059 SQL injection in Schoolbox version 21.0.2, by Schoolbox Pty Ltd
Attackers can extract database information via SQL injection in Schoolbox, affecting both authenticated and unauthenticated users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-3059?
CVE-2022-3059 is a high-severity SQL injection vulnerability in Schoolbox, published on 31 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The application was vulnerable to multiple instances of SQL injection (authenticated and unauthenticated) through a vulnerable parameter. Due to the stacked query support, complex SQL commands could be crafted and injected into the vulnerable parameter and using a sleep based inferential SQL injection it was possible to extract data from the database.
Weakness: CWE-89
Which versions are affected by CVE-2022-3059?
It affects 1 product.
Products include Schoolbox Schoolbox.
How do I fix CVE-2022-3059?
No fix has been published for CVE-2022-3059 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-3059 being exploited?
There is no known exploitation of CVE-2022-3059 in the wild and no public exploit code.
Other vulnerabilities in Schoolbox
- CVE-2024-28094 Blind SQL Injection in Chat functionality in Schoolbox
- CVE-2022-39020 Cross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty Ltd
- CVE-2024-28095 Stored Cross-site Scripting in News functionality in Schoolbox
- CVE-2024-28096 Stored Cross-site Scripting in Class functionality in Schoolbox
- CVE-2024-28097 Stored Cross-site Scripting in Calendar functionality in Schoolbox
Sources
Also known as GHSA-95q2-rgwr-x33j.