CVE-2022-27927
Published: 19 April 2022
Summary
CVE-2022-27927 is a critical-severity SQL Injection (CWE-89) vulnerability in Microfinance Management System Project Microfinance Management System. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is used as the application database. The flaw resides in the course_code and customer_number parameters and is tracked as CWE-89.
An unauthenticated attacker can exploit the issue remotely over the network by supplying crafted input to these parameters, enabling arbitrary SQL commands against the database. With a CVSS score of 9.8 this can result in full confidentiality, integrity, and availability impact on the affected system.
Public proof-of-concept code demonstrating unauthenticated exploitation has been posted to GitHub and Packet Storm. The EPSS score stands at 0.8164.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-32415
Vulnerability details
A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database. An attacker can issue SQL commands to the MySQL database through the vulnerable course_code and/or customer_number parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.