CVE-2022-31347

Critical
|9.8
No Exploit

Plain English Summary

AI-powered analysis for quick understanding

This vulnerability allows an attacker to manipulate the database of the online car wash booking system, potentially leading to unauthorized access or deletion of vehicle records. It can be exploited by sending specially crafted requests to a specific URL, making it critical for system administrators to secure this endpoint.

Technical Description

Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=delete_vehicle.

CVSS Vector Analysis

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
Confidentiality ImpactHigh
Integrity ImpactHigh
Availability ImpactHigh
ScopeUnchanged

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit Resources

Search for proof-of-concept code and exploit modules

Official References

Est. Bounty
$13,000($5K-$15K)
Vendor Response
Grade FPatched in 1357 days

Quick Information

Published

Jun 2, 2022

almost 4 years ago

Last Modified

Feb 18, 2026

about 2 months ago

Vendor

oretnom23

Product

online car wash booking system

Related Vulnerabilities

CVE-2026-3752Medium

This vulnerability allows an attacker to remotely manipulate the date parameter in the daily task report feature of the employee task management system, potentially leading to unauthorized access to the database. To exploit this flaw, the attacker simply needs to send a specially crafted request to the affected system.

CVE-2026-3751Medium

This vulnerability allows an attacker to execute malicious SQL commands on the employee task management system, potentially accessing or manipulating sensitive data. It can be exploited remotely by sending specially crafted requests to a specific part of the application without needing any special access or credentials.

CVE-2026-3746Medium

An attacker can exploit a vulnerability in the login feature of a tourism website to execute unauthorized SQL commands, potentially gaining access to sensitive data in the database. This can be done remotely by manipulating the username input, and the exploit is publicly known, making it easier for attackers to take advantage of it.

CVE-2026-26886Low

This vulnerability allows an attacker to manipulate the database of the online men's salon management system by injecting malicious SQL code through the admin service management page. To exploit this, the attacker needs access to the admin panel, which may require valid login credentials.

CVE-2026-26885Low

This vulnerability allows an attacker to manipulate the database of a men's salon management system by injecting harmful SQL commands through a specific URL. To exploit it, the attacker needs to access the system's delete service function, which could lead to unauthorized data deletion or exposure.