There are two full (read/write) Blind/Time-based SQL injection vulnerabilities in the Northstar Club Management version 6.3 application. The vulnerabilities exist in the userName parameter of the processlogin.jsp page in the /northstar/Portal/ directory and the userID parameter of the login.jsp page in the /northstar/iphone/ directory. Exploitation of the SQL injection vulnerabilities allows full access to the database which contains critical data for organization’s that make full use of the software suite.
References
Link | Resource |
---|---|
https://assura.atlassian.net/wiki/spaces/VULNS/pages/1842675717/CVE-2022-26959+Northstar+Club+Management+software+version+6.3+-+Full+Blind+Time-based+SQL+Injection | Exploit Issue Tracking Third Party Advisory |
https://www.assurainc.com/services/advisory-services/threat-vuln-assessment/ | Broken Link |
https://assura.atlassian.net/wiki/spaces/VULNS/pages/1842675717/CVE-2022-26959+Northstar+Club+Management+software+version+6.3+-+Full+Blind+Time-based+SQL+Injection | Exploit Issue Tracking Third Party Advisory |
https://www.assurainc.com/services/advisory-services/threat-vuln-assessment/ | Broken Link |
Configurations
History
21 Nov 2024, 06:54
Type | Values Removed | Values Added |
---|---|---|
References | () https://assura.atlassian.net/wiki/spaces/VULNS/pages/1842675717/CVE-2022-26959+Northstar+Club+Management+software+version+6.3+-+Full+Blind+Time-based+SQL+Injection - Exploit, Issue Tracking, Third Party Advisory | |
References | () https://www.assurainc.com/services/advisory-services/threat-vuln-assessment/ - Broken Link | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 10.0 |
Information
Published : 2022-09-16 02:15
Updated : 2024-11-21 06:54
NVD link : CVE-2022-26959
Mitre link : CVE-2022-26959
CVE.ORG link : CVE-2022-26959
JSON object : View
Products Affected
globalnorthstar
- northstar_club_management
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')