← back
CVE-2022-30335

CVE-2022-30335

EPSS 1.1%
Bonanza Wealth Management System (BWM) 7.3.2 allows SQL injection via the login form. Users who supply the application with a SQL injection payload in the User Name textbox could collect all passwords in encrypted format from the Microsoft SQL Server component.
Affected products
n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://gist.github.com/aliceicl/b2f25f3a0a3ba9973e4977f922d04008https://incognitolab.comhttps://www.wealth.co.th/products/bonanza-wealth-management/