Cyber Resilience

CVE-2022-26585

CriticalPublic PoC

Published: 05 April 2022

Published
05 April 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.5749 98.2th percentile
Risk Priority 54 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-26585 is a critical-severity SQL Injection (CWE-89) vulnerability in Mingsoft Mcms. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Mingsoft MCMS version 5.2.7 contains a SQL injection vulnerability, tracked as CVE-2022-26585 and assigned CWE-89, that is reachable at the unauthenticated endpoint /cms/content/list. The flaw received a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no required privileges or user interaction, with full impact to confidentiality, integrity, and availability.

An unauthenticated remote attacker can supply crafted input to the affected endpoint and execute arbitrary SQL commands against the underlying database. Successful exploitation therefore permits extraction or modification of stored data, potential authentication bypass, or further lateral movement within the application and its hosting environment.

The associated EPSS score stands at 0.5749 with an identical recorded peak, indicating sustained exploitation interest after public disclosure. The only referenced resource is an issue tracker entry on the project’s Gitee repository that does not describe patches or work-arounds.

EU & UK References

Vulnerability details

Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

mingsoft
mcms
5.2.7

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References