CVE-2022-28079

Deeper analysis

College Management System v1.0 contains a SQL injection vulnerability in the course_code parameter, classified under CWE-89. The flaw received a CVSS 3.1 score of 8.8, reflecting network-accessible exploitation with low attack complexity that allows an authenticated user to impact confidentiality, integrity, and availability.

An authenticated attacker with low privileges can supply crafted input through the affected parameter to execute arbitrary SQL commands. Successful exploitation grants the ability to read, modify, or delete database contents and potentially escalate to full system compromise within the application context.

Public references include exploit code and technical write-ups demonstrating the injection, along with a link to the original project source. The EPSS score rose from low values after the 2022 disclosure to a peak of 0.9043 in January 2025 before receding to the current 0.7295, indicating later-emerging exploitation interest that warrants renewed attention.