critical9.8
CVE-2022-30335
Bonanza Wealth Management System (BWM) 7.3.2 allows SQL injection via the login form.
Impact
Bonanza Wealth Management System (BWM) 7.3.2 allows SQL injection via the login form. Users who supply the application with a SQL injection payload in the User Name textbox could collect all passwords in encrypted format from the Microsoft SQL Server component.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wealth | Bonanza Wealth Management System | Version 7.3.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://gist.github.com/aliceicl/b2f25f3a0a3ba9973e4977f922d04008
- https://incognitolab.com
- https://www.wealth.co.th/products/bonanza-wealth-management/
- https://gist.github.com/aliceicl/b2f25f3a0a3ba9973e4977f922d04008
- https://incognitolab.com
- https://www.wealth.co.th/products/bonanza-wealth-management/