CVE-2022-50892
Published: 13 January 2026
Summary
CVE-2022-50892 is a high-severity SQL Injection (CWE-89) vulnerability in Viaviweb Wallpaper Admin. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2022-50892 is a SQL injection vulnerability (CWE-89) in VIAVIWEB Wallpaper Admin 1.0. The flaw resides in the login page, where attackers can bypass authentication by manipulating login credentials with payloads such as 'admin' or 1=1-- -. This grants unauthorized access to the administrative interface. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high confidentiality impact with low complexity and no prerequisites.
Remote attackers with network access to the login page can exploit this vulnerability without prior authentication or user interaction. By injecting the malicious payloads into the login form, they bypass authentication controls and gain entry to the admin interface, enabling potential unauthorized data access or limited administrative functions.
Advisories and a proof-of-concept exploit detail the issue, available at Exploit-DB (https://www.exploit-db.com/exploits/51033), the vendor site (https://www.viaviweb.com), and VulnCheck (https://www.vulncheck.com/advisories/viaviweb-wallpaper-admin-sql-injection-via-login-page).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2642
Vulnerability details
VIAVIWEB Wallpaper Admin 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating login credentials. Attackers can exploit the login page by injecting 'admin' or 1=1-- - payload to gain unauthorized access to the administrative interface.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app login page enables remote authentication bypass and unauthorized admin access, directly facilitating T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires information input validation at entry points such as the login form, directly preventing SQL injection payloads from bypassing authentication.
SI-2 mandates timely identification, reporting, and remediation of flaws like the SQL injection vulnerability in the login page.
RA-5 requires vulnerability scanning that would identify the SQL injection vulnerability in the authentication mechanism prior to exploitation.