{"id":"CVE-2026-122048","kind":"vulnerability","aliases":["CVE-2026-122048"],"related":[],"title":"Campcodes athletic meet result system: SQL injection via check-user.php abbr","description":"A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.","summary":"Campcodes Division Regional Athletic Meet Game Result Matrix System up to version 2.1 has an SQL injection in /dipam/check-user.php through the abbr argument. A remote attacker can send crafted requests to read or change the application's database, and a public exploit exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Division Regional Athletic Meet Game Result Matrix System","fixed":[],"affected":"<= 2.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["campcodes","other","php","sql-injection"],"not_affected_if":["not-installed","version-above-2.1"],"how_to_check":"- Look for /dipam/check-user.php in the web root; if present, you run the affected app.\n- Check the installed version: 2.1 and earlier are listed as affected.\n- Check web server logs for requests to check-user.php with quotes or SQL keywords in the abbr parameter.","fix":null,"status":"open","published_at":"2026-11-04T23:17:23+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","triaged_at":"2026-11-05T00:31:52+00:00","updated_at":"2026-11-05T00:34:14+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-05T00:31:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Campcodes athletic meet result system: SQL injection via check-user.php abbr","impact":"high","summary":"Campcodes Division Regional Athletic Meet Game Result Matrix System up to version 2.1 has an SQL injection in /dipam/check-user.php through the abbr argument. A remote attacker can send crafted requests to read or change the application's database, and a public exploit exists.","audience":"businesses","category":"other","nicknames":[],"who_cares":["campcodes","php","sql-injection"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads or alters the application's database remotely","analyst_note":"Confirm whether a fixed version or vendor patch exists and whether check-user.php requires authentication, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-122048.","how_to_check":"- Look for the file `/dipam/check-user.php` in the web root of the deployment.\n- Check the installed version of the Game Result Matrix System against `2.1`; the sources say versions up to 2.1 are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["not-installed","version-above-2.1"],"who_is_affected":"Any deployment of the Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1 that exposes /dipam/check-user.php to the network is exposed to remote SQL injection through the abbr argument. The sources do not describe a fixed version or a vendor patch. Teams that do not run this application can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000724,"input_tokens":4243,"output_tokens":600,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a fixed version or vendor patch exists and whether check-user.php requires authentication, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-122048.","search":"'-122048':13A,16A '-2026':12A,15A '/dipam/check-user.php':49B,99C '2.1':43B,90C 'abbr':10A,52B,105C 'affect':92C 'applic':66B 'argument':53B,104C 'athlet':2A,34B,82C 'athletic':19A 'attack':56B,116C 'avail':122C 'campcod':1A,25B,31B,79C 'chang':64B 'check-user.php':9A 'craft':59B 'cve':11A,14A 'databas':68B 'divis':32B,80C 'division':17A 'exist':73B 'exploit':72B,119C 'file':98C 'function':95C 'game':21A,36B,84C 'identifi':77C 'inject':7A,30B,47B,109C 'launch':114C 'lead':106C 'manipul':101C 'matrix':23A,38B,86C 'meet':3A,20A,35B,83C 'might':124C 'php':27B 'possibl':112C 'public':71B,121C 'read':62B 'region':33B,81C 'regional':18A 'remot':55B,117C 'request':60B 'result':4A,22A,37B,85C 'send':58B 'sql':6A,29B,46B,108C 'sql-inject':28B 'system':5A,24A,39B,87C 'unknown':94C 'use':126C 'version':42B 'via':8A 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of the Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1 that exposes /dipam/check-user.php to the network. The CNA (VulDB) scores it as needing no privileges (PR:N), so assume no login is required; this was not confirmed against the code. Teams that do not run this PHP app can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["divisionregionalathleticmeetgameresultmatrixsystem","regionalathleticmeetgameresultmatrixsystem"],"ptokens":["athletic","division","game","matrix","meet","regional","result","system"],"labels":["campcodes","high","other","php","sqlinjection"],"campaign_type":null,"first_public_at":"2026-11-04T23:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122048","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122048","severity":null,"published_at":"2026-11-04T23:17:23+00:00","modified_at":"2026-11-04T23:17:23+00:00","first_seen_at":"2026-11-05T00:30:59+00:00","fetched_at":"2026-11-05T00:30:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122048:1738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122048","severity":null,"published_at":"2026-11-05T00:34:14+00:00","modified_at":"2026-11-05T00:34:14+00:00","first_seen_at":"2026-11-05T00:34:14+00:00","fetched_at":"2026-11-05T00:34:14+00:00","note":"Only source is NVD/VulDB CNA record; no vendor advisory or patch found (Campcodes is a code-sample site, no vendor page). Fix unknown, so fix_status left unmarked. CVSS vector says PR:N. Nothing verified: no vendor primary source. Public exploit referenced by CNA but no link seen. Sibling CVE-2026-3984 (XSS, same product) exists.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-122048"]}],"documents":[{"id":71623,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122048","title":"NVD CVE-2026-122048 (VulDB CNA)","kind":"advisory","source":"analyst","publisher":null,"text":"Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1, /dipam/check-user.php, argument abbr, SQL injection (CWE-89). Remote, exploit public. CVSS 3.1 7.3 PR:N, CVSS 4.0 6.9 by VulDB. No fix listed.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}