CVE-2022-26959

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

There are two full (read/write) Blind/Time-based SQL injection vulnerabilities in the Northstar Club Management version 6.3 application. The vulnerabilities exist in the userName parameter of the processlogin.jsp page in the /northstar/Portal/ directory and the userID parameter of the login.jsp page in the /northstar/iphone/ directory. Exploitation of the SQL injection vulnerabilities allows full access to the database which contains critical data for organization’s that make full use of the software suite.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://assura.atlassian.net/wiki/spaces/VULNS/pages/1842675717/CVE-2022-26959+Northstar+Club+Management+software+version+6.3+-+Full+Blind+Time-based+SQL+InjectionExploit, Issue Tracking, Third Party Advisory
https://www.assurainc.com/services/advisory-services/threat-vuln-assessment/Broken Link
https://assura.atlassian.net/wiki/spaces/VULNS/pages/1842675717/CVE-2022-26959+Northstar+Club+Management+software+version+6.3+-+Full+Blind+Time-based+SQL+InjectionExploit, Issue Tracking, Third Party Advisory
https://www.assurainc.com/services/advisory-services/threat-vuln-assessment/Broken Link

Timeline

Published: Sep 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-26966.5The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX a CVE-2022-269609.1connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, CVE-2022-269615.4Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMS CVE-2022-269625.4Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announce CVE-2022-269647.5Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-f CVE-2022-269657.2In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.CVE-2022-269665.5An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from h CVE-2022-269677.8GPAC 2.0 allows a heap-based buffer overflow in gf_base64_encode. It can be triggered via MP4Box.CVE-2022-269699.8In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.CVE-2022-26977.5A vulnerability was found in SourceCodester Simple E-Learning System. It has been classified as critical. Affected is an unknown function of CVE-2022-269715.3Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. CVE-2022-269726.1Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /cgi-bin endpoint. The URL