CVE-2022-37138

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after injecting username form.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/saitamang/POC-DUMP/blob/main/Loan%20Management%20System/README.mdExploit, Third Party Advisory
https://www.sourcecodester.com/php/15529/loan-management-system-oop-php-mysqlijquery-free-source-code.htmlThird Party Advisory
https://github.com/saitamang/POC-DUMP/blob/main/Loan%20Management%20System/README.mdExploit, Third Party Advisory
https://www.sourcecodester.com/php/15529/loan-management-system-oop-php-mysqlijquery-free-source-code.htmlThird Party Advisory

Timeline

Published: Sep 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-371395.4Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability.CVE-2022-37149.8A vulnerability classified as critical has been found in SourceCodester Online Medicine Ordering System 1.0. Affected is an unknown function CVE-2022-371408.0PayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE). The vulnerability exists on the reply ticket function and upload the CVE-2022-371448.8The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attack CVE-2022-371457.5The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTra CVE-2022-371465.3The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users co CVE-2022-371499.8WAVLINK WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability when operating the file adm.cgi. This vu CVE-2022-37157.8A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory pro CVE-2022-371505.4An issue was discovered in Online Diagnostic Lab Management System 1.0. There is a stored XSS vulnerability via firstname, address, middlena CVE-2022-371517.5There is an unauthorized access vulnerability in Online Diagnostic Lab Management System 1.0.CVE-2022-371529.8An issue was discovered in Online Diagnostic Lab Management System 1.0, There is a SQL injection vulnerability via "dob" parameter in "/clas CVE-2022-371536.1An issue was discovered in Artica Proxy 4.30.000000. There is a XSS vulnerability via the password parameter in /fw.login.php.