CVE-2022-28416

Name of the Vulnerable Software and Affected Versions Home Owners Collection Management System version 1.0

Description A SQL injection issue was found in the Home Owners Collection Management System. The vulnerability can be exploited via the /hocms/classes/Master.php API endpoint, specifically through the f parameter set to delete phase.

Recommendations For Home Owners Collection Management System version 1.0, consider restricting access to the delete phase function in the Master.php file until a patch is available. Avoid using the f parameter in the /hocms/classes/Master.php endpoint with the value delete phase to minimize the risk of exploitation.