CVE-2022-40030
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at changeStatus.php. An attacker can manipulate this parameter to execute unauthorized database queries.
Risk Assessment
The risk includes potential data leakage, modification, or deletion from the database, which could compromise the confidentiality and integrity of organizational information.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, implement input validation and parameterized SQL queries.
Other vulnerabilities in Simple Task Managing System
See all- CVE-2022-40029Medium
A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Simple Task Managing System v1.0 in the newProjectValidation.php component. Attackers can inject arbitrary web scripts or HTML via the shortName parameter.
- CVE-2022-40028Medium
A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Simple Task Managing System v1.0 in the newProjectValidation.php file. Attackers can inject arbitrary web scripts or HTML via the fullName parameter.
- CVE-2022-40027Medium
A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Simple Task Managing System v1.0 via the newTask.php component. Attackers can inject arbitrary web scripts or HTML through the shortName parameter.
Original NVD description (English source)
SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at changeStatus.php.