CVE-2022-30413

Name of the Vulnerable Software and Affected Versions Covid-19 Travel Pass Management System version 1.0

Description The issue concerns a SQL Injection vulnerability. It can be exploited via the /ctpms/classes/Master.php API endpoint, specifically when the f parameter is set to delete application.

Recommendations For Covid-19 Travel Pass Management System version 1.0, consider disabling the delete application function in the Master.php file as a temporary workaround until a patch is available. Restrict access to the /ctpms/classes/Master.php endpoint to minimize the risk of exploitation. Avoid using the f parameter in the affected API endpoint until the issue is resolved.