cve/2022/CVE-2022-25228.md

### [CVE-2022-25228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25228)
![](https://img.shields.io/static/v1?label=Product&message=CandidATS&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20injection&color=brighgreen)

### Description

CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameter, in '/index.php?m=candidates&a=show' via the 'candidateID', in '/index.php?m=joborders&a=show' via the 'jobOrderID' and '/index.php?m=companies&a=show' via the 'companyID' parameter

### POC

#### Reference
- https://fluidattacks.com/advisories/jackson/

#### Github
No PoCs found on GitHub currently.