Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Open Source SACCO Management System v1.0 vulnerable to SQL Injection via /sacco_shield/manage_loan.php.

CVE-2022-42218 is a high-severity SQL Injection vulnerability identified in the Open Source SACCO Management System version 1.0, specifically exploitable via the /sacco_shield/manage_loan.php endpoint. SQL Injection (CWE-89) vulnerabilities occur when untrusted input is improperly sanitized and directly incorporated into SQL queries, allowing an attacker to manipulate the database queries executed by the application. In this case, the vulnerability allows an attacker with high privileges (PR:H) and network access (AV:N) to execute arbitrary SQL commands without requiring user interaction (UI:N). The vulnerability impacts confidentiality, integrity, and availability (C:H/I:H/A:H) of the system, enabling potential data exfiltration, unauthorized data modification, or denial of service. The CVSS 3.1 base score of 7.2 reflects a high severity due to ease of exploitation over the network with low attack complexity (AC:L) and no user interaction required. Although no known exploits are currently reported in the wild, the absence of patches or vendor-provided fixes increases the risk for organizations using this software. The SACCO Management System is typically used by Savings and Credit Cooperative Organizations to manage loans and financial transactions, making the data highly sensitive and critical for operational continuity.

Detailed information about CVE-2022-42218: n/a in n/a affecting n/a n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2022-42218: n/a in n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-42218: n/a in n/a

Open Source SACCO Management System v1.0 is vulnerable to SQL Injection via /sacco_shield/manage_payment.php.

CVE-2022-42143 is a high-severity SQL Injection vulnerability identified in the Open Source SACCO Management System version 1.0, specifically exploitable via the /sacco_shield/manage_payment.php endpoint. SQL Injection (CWE-89) vulnerabilities occur when untrusted input is improperly sanitized and directly included in SQL queries, allowing attackers to manipulate the database queries executed by the application. In this case, the vulnerability enables an attacker with high privileges (PR:H) to remotely execute arbitrary SQL commands over the network (AV:N) without requiring user interaction (UI:N). The vulnerability affects confidentiality, integrity, and availability (C:H/I:H/A:H) of the system, meaning an attacker could potentially extract sensitive data, modify or delete records, or disrupt service availability. The CVSS 3.1 base score of 7.2 reflects a high severity due to the ease of exploitation (low attack complexity) and the broad impact on the system. Although the exact affected versions and vendor details are not specified, the vulnerability is tied to an open-source SACCO (Savings and Credit Cooperative Organization) management system, which is typically used by financial cooperatives to manage member accounts and payments. No patches or known exploits in the wild have been reported yet, but the presence of this vulnerability poses a significant risk to organizations relying on this software for financial transaction management.

Detailed information about CVE-2022-42143: n/a in n/a affecting n/a n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2022-42143: n/a in n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-42143: n/a in n/a

Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_borrower.

CVE-2022-41530 is a high-severity SQL injection vulnerability identified in the Open Source SACCO Management System version 1.0. The vulnerability exists in the 'id' parameter of the endpoint /sacco_shield/ajax.php?action=delete_borrower. SQL injection (CWE-89) occurs when untrusted input is improperly sanitized and directly incorporated into SQL queries, allowing an attacker to manipulate the database query executed by the application. In this case, the 'id' parameter is vulnerable, enabling an attacker with high privileges (PR:H) to execute arbitrary SQL commands remotely (AV:N) without requiring user interaction (UI:N). The vulnerability affects confidentiality, integrity, and availability (C:H/I:H/A:H) of the system, as an attacker could extract sensitive data, modify or delete records, or disrupt service. The CVSS 3.1 base score of 7.2 reflects the ease of exploitation due to low attack complexity (AC:L) and the significant impact on the system. Although no known exploits are currently reported in the wild, the vulnerability poses a serious risk to organizations using this SACCO Management System, which is typically used by Savings and Credit Cooperative Organizations to manage member loans and financial transactions. The lack of vendor or product-specific information limits detailed attribution, but the vulnerability's presence in an open-source financial management tool suggests potential exposure in environments relying on this software for critical financial operations.

Detailed information about CVE-2022-41530: n/a in n/a affecting n/a n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2022-41530: n/a in n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-41530: n/a in n/a

Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_plan.

CVE-2022-41532 is a high-severity SQL injection vulnerability identified in the Open Source SACCO Management System version 1.0. The vulnerability exists in the 'id' parameter of the endpoint /sacco_shield/ajax.php?action=delete_plan. This parameter is susceptible to SQL injection attacks, allowing an attacker with high privileges (PR:H) to execute arbitrary SQL commands on the backend database without requiring user interaction (UI:N). The vulnerability has a CVSS 3.1 base score of 7.2, indicating a high impact on confidentiality, integrity, and availability. Exploiting this flaw could allow an attacker to manipulate or delete sensitive data, escalate privileges, or disrupt the availability of the SACCO Management System. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), but requires authenticated access, which limits exploitation to users with some level of system access. The vulnerability is categorized under CWE-89, which corresponds to SQL injection, a common and critical web application security issue. No patches or fixes have been linked or published yet, and there are no known exploits in the wild at this time. The SACCO Management System is typically used by Savings and Credit Cooperative Organizations (SACCOs) to manage member accounts, loans, and financial transactions, making the confidentiality and integrity of data critical for operational and regulatory compliance.

Detailed information about CVE-2022-41532: n/a in n/a affecting n/a n/a. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Affecting Tanzania

Filter Threats

Threats Affecting Tanzania

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility