cbcvebase.
CVE-2022-28080
published 2022-05-05

CVE-2022-28080: Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.

PriorityP266high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
57.32%
99.0th percentile
Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.

Affected

1 ranges
VendorProductVersion rangeFixed in
event_management_system_projectevent_management_system——

Detection & IOCsextracted from sources · hover to see the quote

url/royal_event/btndates_report.php↗
command-1%27+OR+1%3d1+OR+%27ns%27%3d%27ns↗
command-1' OR 1=1 OR 'ns'='ns↗
command1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(md5("{{randstr}}"),0x1,0x2),NULL-- -↗
  • →Monitor for POST requests to /royal_event/btndates_report.php containing SQL injection patterns in the 'todate' multipart form-data parameter (e.g., OR, UNION ALL SELECT, single quotes). ↗
  • →The exploit requires authentication; look for a preceding POST login request to /royal_event/ followed immediately by the injection request to /royal_event/btndates_report.php from the same session. ↗
  • →The UNION-based payload targets 16 columns; detection signatures should look for UNION ALL SELECT with multiple NULL values and CONCAT(md5(...)) in the todate field. ↗
  • →The multipart boundary value f289a6438bcc45179bcd3eb7ddc555d0 is present in the PoC request and may appear in exploit traffic. ↗
  • ·Exploitation requires prior authentication to the Royal Event Management System; unauthenticated access alone is insufficient to trigger the SQL injection. ↗
  • ·The vulnerability is in the 'todate' POST parameter submitted as multipart/form-data, not as a URL query parameter, so WAF rules must inspect multipart request bodies. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.