Vulnerability Description
PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information through error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilit
- https://github.com/qinggan/phpok/commit/d70c396f
- https://www.vulncheck.com/advisories/phpok-5.4.081-sql-injection-via-api-php-sor
FAQ
What is CVE-2022-51023?
CVE-2022-51023 is a vulnerability with a CVSS score of 8.2 (HIGH). PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /ap...
How severe is CVE-2022-51023?
CVE-2022-51023 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-51023?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.