CVE-2022-26959

CVE-2022-26959 describes two critical blind/time-based SQL injection vulnerabilities in Northstar Club Management version 6.3, specifically affecting the userName parameter in processlogin.jsp and the userID parameter in login.jsp. These vulnerabilities allow unauthenticated attackers to gain full read/write access to the application's database, which often contains sensitive organizational data. With a CVSS score of 9.8 (Critical), exploitation is straightforward, requiring no user interaction or prior authentication, and can lead to complete compromise of confidentiality, integrity, and availability. While no public exploits, Metasploit modules, or active exploitation have been observed, and community discussion is minimal, the high FAUCET Risk Score of 77/100 indicates its significant potential impact.