CVE-2022-24264
Published: 31 January 2022
Summary
CVE-2022-24264 is a high-severity SQL Injection (CWE-89) vulnerability in Cuppacms Cuppacms. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 5.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Cuppa CMS version 1.0 contains a SQL injection vulnerability tracked as CVE-2022-24264. The flaw resides in the table_manager component at the path /administrator/components/table_manager/ and is triggered through the search_word parameter. It is classified under CWE-89 and carries a CVSS 3.1 score of 7.5, reflecting network-accessible exploitation with no required credentials or user interaction and a high impact on confidentiality.
An unauthenticated remote attacker can supply crafted input to the search_word parameter and execute arbitrary SQL queries against the backend database. Successful exploitation allows extraction of sensitive data stored in the application without any prior authentication or interaction from legitimate users.
The EPSS score for this CVE rose from a low baseline to a peak of 0.6362 on 2025-12-11 before receding to the current value of 0.1312, indicating a period of increased exploitation interest well after the original disclosure. Public references consist of GitHub issue reports and proof-of-concept repositories that document the injection vector but provide no official patch or mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29171
Vulnerability details
Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the search_word parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.