CVE-2022-24240

CriticalCVSS 9.8

Published: 02/06/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.87%

54th percentile - higher than 54% of all known CVEs

Summary

ACEweb Online Portal 3.5.065 was found to have a SQL injection vulnerability via the 'criteria' parameter in showschedule.awp. An attacker can manipulate database queries, potentially leading to unauthorized data access.

Risk Assessment

The risk includes potential leakage of sensitive data, modification or deletion of database records, and possible privilege escalation within the system.

Recommendation

Immediately update ACEweb Online Portal to the latest version and implement parameterized SQL queries or prepared statements in the application code.

Original NVD description (English source)

ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp.