CVE-2022-30011: SQL Injection
In HMS 1.0 when requesting appointment.php through POST, multiple parameters can lead to a SQL injection vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-30011.
What is the severity rating of CVE-2022-30011?
CVE-2022-30011 has a severity rating of 9.8 (critical).
How does CVE-2022-30011 affect the HMS software?
CVE-2022-30011 affects HMS 1.0, specifically when requesting appointment.php through POST method.
How can multiple parameters in the POST request of appointment.php lead to a SQL injection vulnerability?
The SQL injection vulnerability occurs when the input from the multiple parameters is not properly validated or sanitized, allowing an attacker to execute arbitrary SQL commands.
Are there any references or further information available for CVE-2022-30011?
Yes, you can find more information about CVE-2022-30011 and potential fixes on the following GitHub links: [https://github.com/kabirkhyrul/HMS/discussions/15](https://github.com/kabirkhyrul/HMS/discussions/15) and [https://github.com/kabirkhyrul/HMS/tree/1.0](https://github.com/kabirkhyrul/HMS/tree/1.0).