CVE-2022-4871

CVE-2022-4871 is a high-severity SQL injection vulnerability affecting nflpick-em.com versions up to 2.2.x, specifically within the _Load_Users function of the LoadUsers.php file. This flaw allows a remote attacker with administrative privileges to manipulate the 'sort' argument, leading to full compromise of confidentiality, integrity, and availability. While the CVSS score is 7.2, exploitation requires an authenticated administrator account, limiting its attack surface. There is currently no public exploit code available, nor is there evidence of active exploitation or significant community discussion.