CVE-2022-1838 MEDIUM

CVE-2022-1838: Home Clean Services Management System login.php sql injection

Vendor Unspecified
Product Home Clean Services Management System
Weakness CWE-89 · SQLi
Published May 24, 2022
Last update April 15, 2025

CVSS base score

4.7/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability classified as critical has been found in Home Clean Services Management System 1.0. This affects an unknown part of admin/login.php. The manipulation of the argument username with the input admin%'/**/AND/**/(SELECT/**/5383/**/FROM/**/(SELECT(SLEEP(5)))JPeh)/**/AND/**/'frfq%'='frfq leads to sql injection. It is possible to initiate the attack remotely but it requires authentication. Exploit details have been disclosed to the public.

Key dates

02Disclosure timeline

May 24, 2022 CVE published
April 15, 2025 Record updated