CVE-2022-28080: Royal Event Management System todate parameter SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS is 8.8 with high confidentiality, integrity and availability impact, public exploit code exists, and EPSS is in the 99th percentile, though exploitation requires a low-privileged account.

What it is

Royal Event Management System v1.0 contains a SQL injection flaw in the todate parameter. An authenticated attacker can inject SQL through that parameter, which matters because it can expose or alter the underlying database. The record does not list affected versions beyond v1.0 or a fixed release.

Impact

An attacker with a valid account can read, modify or delete database contents and potentially reach data beyond the intended query. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The flaw is reached over the network through the todate parameter, with no user interaction required. The CVSS vector shows PR:L, and the reference title marks the exploit as authenticated, so a low-privileged account is needed.

Exploitation

Public exploit code exists in Packet Storm and a GitHub repository, and EPSS is 0.56907 (99th percentile), indicating elevated likelihood. CISA KEV does not list it and no ransomware use is documented.

What to do

• Apply the vendor fix or upgrade to a release later than v1.0 if one is available; the record does not name a patched version.
• If no patch exists, validate and parameterize the todate input and remove string concatenation in the SQL query.
• Restrict access to the event management application to trusted networks and remove or disable unused accounts.
• Enforce least privilege on the database account used by the application to limit read and write scope.
• Monitor and rate-limit requests to the vulnerable endpoint.

Detection

• Review web and database logs for SQL syntax, UNION, or comment sequences in the todate parameter.
• Alert on unusual query volume or errors from the event management application.
• Track authentication events followed by anomalous database access from the same session.
• Search for known exploit payloads from the public Packet Storm and GitHub references.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.