CVE-2022-30512: School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31.

PriorityP261critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

9.62%

94.9th percentile

School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
school_dormitory_management_system_project	school_dormitory_management_system	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/dms/admin/accounts/payment_history.php?account_id=2%27↗

pathaccounts/payment_history.php↗

→HTTP GET request to /dms/admin/accounts/payment_history.php with a single-quote appended to the account_id parameter (e.g., account_id=2') triggers the SQL injection. ↗
→Vulnerable response body contains all three strings simultaneously: 'Fatal error', 'Uncaught Error: Call to a member function fetch_assoc()', and 'Month of' — use AND logic to confirm exploitation. ↗
→Response Content-Type header must be text/html and HTTP status code 200 to confirm the vulnerable error disclosure path is reached. ↗

·The SQL injection is unauthenticated (PR:N) and network-reachable (AV:N), requiring no user interaction — exploitation is trivially scriptable against any exposed instance. ↗
·The vulnerable parameter is account_id at line 31 of payment_history.php; only School Dormitory Management System version 1.0 is confirmed affected. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.