CVE-2022-24223: AtomCMS admin login SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit references, and a very high EPSS score make this an urgent exposure for any internet-facing AtomCMS v2.0 instance.

What it is

AtomCMS v2.0 contains a SQL injection vulnerability reached through /admin/login.php. The flaw is rated critical (CVSS 9.8) and public exploit references exist, so any exposed instance is a realistic target.

Impact

An unauthenticated attacker can inject SQL through the login endpoint, potentially reading or modifying database contents and bypassing authentication. Given the CVSS scope, full compromise of confidentiality, integrity and availability is possible.

Attack surface

Reachable over the network via HTTP requests to /admin/login.php; the CVSS vector shows no privileges and no user interaction required. No authentication is needed to reach the vulnerable endpoint.

Exploitation

Not listed in CISA KEV, but EPSS is 0.61965 (99th percentile) and both references are tagged Exploit, indicating public exploit material is available.

What to do

• Apply the vendor fix or upgrade AtomCMS past v2.0 if a patched release exists; verify against the project's issue tracker.
• If no patch is available, take the admin login page off the public internet or place it behind a VPN or IP allowlist.
• Use parameterized queries or prepared statements for all login form database access.
• Deploy a WAF rule targeting SQL injection patterns on /admin/login.php as a stopgap.
• Rotate database credentials and review database logs for tampering if exposure is suspected.

Detection

• Monitor web logs for SQL metacharacters (quotes, UNION, OR 1=1, comment sequences) in POST bodies to /admin/login.php.
• Alert on repeated failed login attempts from a single source against the admin login endpoint.
• Review database query logs for anomalous or malformed statements originating from the web application.
• Check for unexpected changes to admin user records or authentication bypass events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.