Login Sign Up

CVE-2022-28093

9.8 CRITICAL
Remote Code Execution

📋 TL;DR

This vulnerability allows attackers to include local PHP files in SCBS Online Sports Venue Reservation System v1.0, potentially leading to arbitrary code execution. Attackers can upload crafted PHP files and then include them through the vulnerable functionality. All users running version 1.0 of this system are affected.

💻 Affected Systems

Products:
  • SCBS Online Sports Venue Reservation System
Versions: v1.0
Operating Systems: Any OS running PHP
Default Config Vulnerable: ⚠️ Yes
Notes: Requires PHP environment and file upload functionality to be accessible.

📦 What is this software?

Online Sports Complex Booking System by Online Sports Complex Booking System Project

View all CVEs affecting Online Sports Complex Booking System →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise with attacker gaining full control over the web server, accessing sensitive data, and potentially pivoting to other systems.

🟠

Likely Case

Remote code execution leading to data theft, website defacement, or installation of backdoors/malware.

🟢

If Mitigated

Limited impact with proper file upload restrictions and input validation preventing exploitation.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Public GitHub repository contains detailed exploitation steps and proof-of-concept.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Unknown

Vendor Advisory: http://scbs.com

Restart Required: No

Instructions:

No official patch available. Consider upgrading to a newer version if available or implementing workarounds.

🔧 Temporary Workarounds

Disable File Upload

all

Remove or disable file upload functionality in the application

Input Validation

all

Implement strict input validation to prevent path traversal and file inclusion

🧯 If You Can't Patch

  • Implement web application firewall (WAF) rules to block file inclusion attempts
  • Restrict file uploads to specific directories with proper permissions

🔍 How to Verify

Check if Vulnerable:

Test if you can include local files through the application's file upload or parameter manipulation functionality

Check Version:

Check application version in admin panel or source code

Verify Fix Applied:

Attempt exploitation after implementing controls to confirm vulnerability is mitigated

📡 Detection & Monitoring

Log Indicators:

  • Unusual file uploads
  • Requests with path traversal patterns
  • PHP file execution from unexpected locations

Network Indicators:

  • HTTP requests with file inclusion patterns
  • Unusual file upload traffic

SIEM Query:

web_requests WHERE (uri CONTAINS '..' OR uri CONTAINS 'php://' OR uri CONTAINS 'file://') AND src_ip NOT IN trusted_ips

📊 Metadata

CVE ID: CVE-2022-28093
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: April 25, 2022
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON