Live › vulnerability › CVE-2022-51023
Go to dashboardPHPOK versions 4.5.000 through 5.4.080 let anonymous visitors inject SQL through the sort parameter of /api.php?c=project&f=index. An attacker can pull database contents out through error messages.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
4.5.000 up to but not including 5.4.081 are affected5.4.081 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information through error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
This page as .md · .json · in your agent: get_signal("CVE-2022-51023")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.