CVE-2022-32015
Published: 02 June 2022
Summary
CVE-2022-32015 is a high-severity SQL Injection (CWE-89) vulnerability in Complete Online Job Search System Project Complete Online Job Search System. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 6.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Complete Online Job Search System v1.0 contains a SQL injection vulnerability (CWE-89) that can be triggered through the search parameter in the endpoint /eris/index.php?q=category&search=. The flaw allows an attacker to supply crafted input that is concatenated directly into a database query without proper sanitization or parameterization.
Exploitation requires network access and an account with high privileges, after which an attacker can read, modify, or delete arbitrary database contents, resulting in complete loss of confidentiality, integrity, and availability. The CVSS 7.2 vector reflects these constraints and impacts.
Public references consist solely of a proof-of-concept report demonstrating the injection; no vendor advisory, patch information, or mitigation guidance is provided. The associated EPSS score reached a peak of 0.1660 and currently stands at 0.1178, indicating moderate and sustained but not sharply escalating exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-53309
Vulnerability details
Complete Online Job Search System v1.0 is vulnerable to SQL Injection via /eris/index.php?q=category&search=.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.