← Vulnerability feed

Vulnerability record · CVE-2022-29667 · published 26 May 2022

CVE-2022-29667: Chshcms cscms music portal system sql injection vulnerability

Chshcms · Cscms Music Portal System

CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via /admin.php/pic/admin/pic/hy. This vulnerability is exploited via restoring deleted photos.

8.8 CVSS 3.1 High EPSS 0.96% · top 40.1% CWE-89 · SQL injection
8.8CVSS 3.1 base score, v2 6.5
0.96%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via /admin.php/pic/admin/pic/hy. This vulnerability is exploited via restoring deleted photos.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/chshcms/cscms/issues/26#issue-1207651726 ExploitIssue TrackingThird Party Advisory
https://github.com/chshcms/cscms/issues/26#issue-1207651726 ExploitIssue TrackingThird Party Advisory

Track CVE-2022-29667 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-29660Chshcms cscms music portal system sql injection vulnerabilityCSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/pic/del.EPSS 12%8.8CVE-2022-29664Chshcms cscms music portal system sql injection vulnerabilityCSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/pl_save.EPSS 0.96%8.8CVE-2022-29669Chshcms cscms music portal system sql injection vulnerabilityCSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/zhuan.EPSS 0.96%8.8CVE-2022-29685Chshcms cscms music portal system sql injection vulnerabilityCSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/User/level_sort.EPSS 0.96%7.2CVE-2022-29687Chshcms cscms music portal system sql injection vulnerabilityCSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/level_del.EPSS 0.94%7.2CVE-2022-29688Chshcms cscms music portal system sql injection vulnerabilityCSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/h…EPSS 0.94%7.2CVE-2022-29689Chshcms cscms music portal system sql injection vulnerabilityCSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/d…EPSS 0.94%7.2CVE-2022-29661Chshcms cscms music portal system sql injection vulnerabilityCSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/save.EPSS 0.94%

Source: NIST National Vulnerability Database (record CVE-2022-29667), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.