CVE-2022-21666 HIGH

CVE-2022-21666: SQL Injection in useredit.php

Vendor Aaron-Junker
Product USOC
Weakness CWE-89 · SQLi
Published January 10, 2022
Last update April 23, 2025
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Useful Simple Open-Source CMS (USOC) is a content management system (CMS) for programmers. Versions prior to Pb2.4Bfx3 allowed Sql injection in usersearch.php only for users with administrative privileges. Users should replace the file `admin/pages/useredit.php` with a newer version. USOC version Pb2.4Bfx3 contains a fixed version of `admin/pages/useredit.php`.

Key dates

02Disclosure timeline

January 10, 2022 CVE published
April 23, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-2774 SourceCodester Library Management System student.php sql injection CVE-2025-9050 projectworlds Travel Management System addcategory.php sql injection CVE-2025-2186 Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.1 - Unauthenticated SQL Injection via 'automationId' CVE-2022-3243 Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi CVE-2024-5396 itsourcecode Online Student Enrollment System newfaculty.php sql injection