CVE-2022-26585
Published: 05 April 2022
Summary
CVE-2022-26585 is a critical-severity SQL Injection (CWE-89) vulnerability in Mingsoft Mcms. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Mingsoft MCMS version 5.2.7 contains a SQL injection vulnerability, tracked as CVE-2022-26585 and assigned CWE-89, that is reachable at the unauthenticated endpoint /cms/content/list. The flaw received a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no required privileges or user interaction, with full impact to confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply crafted input to the affected endpoint and execute arbitrary SQL commands against the underlying database. Successful exploitation therefore permits extraction or modification of stored data, potential authentication bypass, or further lateral movement within the application and its hosting environment.
The associated EPSS score stands at 0.5749 with an identical recorded peak, indicating sustained exploitation interest after public disclosure. The only referenced resource is an issue tracker entry on the project’s Gitee repository that does not describe patches or work-arounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-1789
Vulnerability details
Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.