CVE-2022-4015

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in Sports Club Management System 119. This affects an unknown part of the file admin/make_payments.php. The manipulation of the argument m_id/plan leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213789 was assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-707 CWE-89

Affected software

Vendor	Product	Versions
unspecified	Sports Club Management System	119

References

https://github.com/shreyansh225/Sports-Club-Management-System/issues/6Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?id.213789Third Party Advisory
https://github.com/shreyansh225/Sports-Club-Management-System/issues/6Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?id.213789Third Party Advisory

Timeline

Published: Nov 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-401507.5Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on u CVE-2022-401517.5Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied inp CVE-2022-401527.5Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is runn CVE-2022-401596.5** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is in CVE-2022-40166.5The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for Woo CVE-2022-401606.5** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is in CVE-2022-40178.8The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for Woo CVE-2022-401768.0A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), D CVE-2022-401775.7A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), D CVE-2022-401785.4A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), D CVE-2022-401798.1A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), D CVE-2022-40184.3Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.