CVE-2022-26348

CVE-2022-26348 is a SQL Injection vulnerability affecting Gallagher Command Centre versions 8.60 prior to 8.60.1652, 8.50 prior to 8.50.2245, 8.40 prior to 8.40.2216, 8.30 prior to 8.30.1470, and all 8.20 and prior versions. An authenticated attacker with local access can manipulate Windows Registry settings for date fields, allowing the Visitor Management Kiosk application to execute arbitrary SQL queries preloaded into the server's registry. This medium-severity vulnerability (CVSS 5.5) has low attack complexity and requires local access, potentially leading to high confidentiality impact by enabling sensitive information disclosure. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.