CVE-2022-29316
Published: 11 May 2022
Summary
CVE-2022-29316 is a critical-severity SQL Injection (CWE-89) vulnerability in Complete Online Job Search System Project Complete Online Job Search System. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Complete Online Job Search System v1.0 contains a SQL injection vulnerability (CWE-89) reachable at the endpoint /eris/index.php?q=result&searchfor=advancesearch. The flaw received a CVSS 3.1 base score of 9.8, reflecting network attackability without authentication or user interaction and full impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply crafted input through the affected search parameter to execute arbitrary SQL commands against the back-end database, enabling data exfiltration, modification, or deletion and potential takeover of the application server. The single disclosed reference is a technical write-up that reproduces the injection but provides no vendor patch or mitigation guidance.
The associated EPSS score stands at 0.6041 with an identical recorded peak, indicating sustained but not newly emergent exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-33658
Vulnerability details
Complete Online Job Search System v1.0 was discovered to contain a SQL injection vulnerability via /eris/index.php?q=result&searchfor=advancesearch.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.