CVE-2022-3129

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in codeprojects Online Driving School. It has been rated as critical. Affected by this issue is some unknown functionality of the file /registration.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-207872.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
codeprojects	Online Driving School	n/a

References

https://github.com/KingBridgeSS/Online_Driving_School_Project_In_PHP_With_Source_Code_Vulnerabilities/blob/main/arbitrary_file_upload.mdExploit, Third Party Advisory
https://vuldb.com/?id.207872Third Party Advisory, VDB Entry
https://github.com/KingBridgeSS/Online_Driving_School_Project_In_PHP_With_Source_Code_Vulnerabilities/blob/main/arbitrary_file_upload.mdExploit, Third Party Advisory
https://vuldb.com/?id.207872Third Party Advisory, VDB Entry

Timeline

Published: Sep 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-312905.4A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrary web scripts or HTM CVE-2022-312917.5An issue in dlt_config_file_parser.c of dlt-daemon v2.18.8 allows attackers to cause a double free via crafted TCP packets.CVE-2022-312946.5An issue in the save_users() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily create or update use CVE-2022-312957.5An issue in the delete_post() function of Online Discussion Forum Site 1 allows unauthenticated attackers to arbitrarily delete posts.CVE-2022-312969.8Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/posts/view_post.php.CVE-2022-312985.4A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via CVE-2022-312996.1Haraj v3.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the User Upgrade Form.CVE-2022-31309.8A vulnerability classified as critical has been found in codeprojects Online Driving School. This affects an unknown part of the file /login CVE-2022-313005.4A cross-site scripting vulnerability in the DM Section component of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via CVE-2022-313015.4Haraj v3.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Post Ads component.CVE-2022-313025.4maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.CVE-2022-313035.4maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.