CVE-2022-4274

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in House Rental System. Affected is an unknown function of the file /view-property.php. The manipulation of the argument property_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-214770 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-707CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Dec 3, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-427435.3deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the applicatiCVE-2022-427449.8CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the apCVE-2022-427457.5CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulCVE-2022-427466.1CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This CVE-2022-427476.1CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is CVE-2022-427486.1CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. TCVE-2022-427496.1CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is poCVE-2022-42759.8A vulnerability has been found in House Rental System and classified as critical. Affected by this vulnerability is an unknown functionalityCVE-2022-427508.8CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does noCVE-2022-427518.8CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffeCVE-2022-427536.1SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does notCVE-2022-427545.5In npu driver, there is a memory corruption due to a use after free. This could lead to local denial of service in kernel.
CVE-2022-4274: Critical severity, CVSS 9.8 | Vulnix