CVE-2022-4222

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Canteen Management System. It has been rated as critical. This issue affects the function query of the file ajax_invoice.php of the component POST Request Handler. The manipulation of the argument search leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214523.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-707 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Canteen Management System	n/a

References

https://vuldb.com/?id.214523Third Party Advisory, VDB Entry
https://www.jianshu.com/p/bda61089bf1dExploit, Third Party Advisory
https://vuldb.com/?id.214523Third Party Advisory, VDB Entry
https://www.jianshu.com/p/bda61089bf1dExploit, Third Party Advisory

Timeline

Published: Nov 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-422218.8Netgear R6220 v1.1.0.114_1.0.1 suffers from Incorrect Access Control, resulting in a command injection vulnerability.CVE-2022-422255.4Jumpserver 2.10.0 <= version <= 2.26.0 contains multiple stored XSS vulnerabilities because of improper filtering of user input, which can e CVE-2022-422277.5jsonlint 1.0 is vulnerable to heap-buffer-overflow via /home/hjsz/jsonlint/src/lexer.CVE-2022-422298.8Wedding Planner v1.0 is vulnerable to Arbitrary code execution via package_edit.php.CVE-2022-42238.8The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities suc CVE-2022-422307.2Simple Cold Storage Management System v1.0 is vulnerable to SQL Injection via /csms/admin/?page=user/manage_user&id=.CVE-2022-422327.2Simple Cold Storage Management System v1.0 is vulnerable to SQL Injection via /csms/classes/Master.php?f=delete_storage.CVE-2022-422339.8Tenda 11N with firmware version V5.07.33_cn suffers from an Authentication Bypass vulnerability.CVE-2022-422348.8There is a file inclusion vulnerability in the template management module in UCMS 1.6 CVE-2022-422355.4A Stored XSS issue in Student Clearance System v.1.0 allows the injection of arbitrary JavaScript in the Student registration form.CVE-2022-422365.4A Stored XSS issue in Merchandise Online Store v.1.0 allows to injection of Arbitrary JavaScript in edit account form.CVE-2022-422379.8A SQL Injection issue in Merchandise Online Store v.1.0 allows an attacker to log in to the admin account.