CVE-2022-32094
Published: 01 July 2022
Summary
CVE-2022-32094 is a critical-severity SQL Injection (CWE-89) vulnerability in Hospital Management System Project Hospital Management System. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 3.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Hospital Management System v1.0 contains a SQL injection vulnerability tracked as CVE-2022-32094, specifically in the loginid parameter processed by doctorlogin.php. The flaw is classified under CWE-89 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible, unauthenticated exploitation with high impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply crafted input through the affected login endpoint to manipulate backend SQL queries. Successful exploitation grants the ability to extract, modify, or delete database contents and potentially escalate to full system compromise without any user interaction or credentials.
Public references consist of GitHub repositories that demonstrate the injection vector, but no vendor advisories, patches, or official mitigation guidance are included among the provided sources.
The associated EPSS score currently stands at 0.2681 with a recorded peak of 0.3543, indicating sustained third-party interest in the issue after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-53362
Vulnerability details
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at doctorlogin.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.