CVE-2022-31384
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
Directory Management System v1.0 was found to have a SQL injection vulnerability in the fullname parameter of add-directory.php. An attacker can exploit this flaw to execute unauthorized database queries.
Risk Assessment
The risk includes potential theft, modification, or deletion of database data, compromising the confidentiality and integrity of organizational information.
Recommendation
Immediately update the system to the latest version or apply a security patch that filters and validates input data in the fullname parameter.
Other vulnerabilities in Directory Management System
See all- CVE-2022-31383Critical
Directory Management System v1.0 was found to have a SQL injection vulnerability in the editid parameter of view-directory.php. An attacker can exploit this flaw to execute unauthorized database queries.
- CVE-2022-31382Critical
Directory Management System v1.0 was found to have a SQL injection vulnerability in the searchdata parameter of search-dirctory.php. An attacker can exploit this flaw to execute unauthorized database queries.
Original NVD description (English source)
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php.