CVE-2022-28452
Published: 29 April 2022
Summary
CVE-2022-28452 is a critical-severity SQL Injection (CWE-89) vulnerability in Redplanetcomputers Laundry Management System. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 16.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Red Planet Laundry Management System version 1.0 contains a SQL injection vulnerability tracked as CVE-2022-28452. The flaw is classified under CWE-89 and carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no required privileges or user interaction. The affected component is the web-facing login and data-handling routines of this laundry management application available from SourceForge and the vendor site at laundry.redplanetcomputers.com.
Unauthenticated remote attackers can supply crafted input to backend database queries and thereby read, modify, or delete arbitrary data, or potentially execute operating-system commands. Successful exploitation grants complete confidentiality, integrity, and availability impact on the underlying database and application server.
Public references consist primarily of proof-of-concept repositories that demonstrate the injection points; no vendor advisory, patch, or official mitigation guidance appears among the listed sources. The EPSS score rose from lower values to a peak of 0.0710 before receding to the current 0.0199, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-32896
Vulnerability details
Red Planet Laundry Management System 1.0 is vulnerable to SQL Injection.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.