Vulnerability record · CVE-2022-2086 · published 15 June 2022
CVE-2022-2086: Bank management system project bank management system sql injection vulnerability
BBank Management System Project · Bank Management System
A vulnerability, which was classified as critical, has been found in SourceCodester Bank Management System 1.0. Affected by this issue is login.php. The manipulation of the argument password with the input 1'and 1=2 union select 1,sleep(10),3,4,5 --+ leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Description
A vulnerability, which was classified as critical, has been found in SourceCodester Bank Management System 1.0. Affected by this issue is login.php. The manipulation of the argument password with the input 1'and 1=2 union select 1,sleep(10),3,4,5 --+ leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/joinia/webray.com.cn/blob/main/php-bank/phpbanksql.md | ExploitThird Party Advisory |
| https://vuldb.com/?id.202034 | Permissions RequiredThird Party Advisory |
| https://github.com/joinia/webray.com.cn/blob/main/php-bank/phpbanksql.md | ExploitThird Party Advisory |
| https://vuldb.com/?id.202034 | Permissions RequiredThird Party Advisory |
Track CVE-2022-2086 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-2086), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
