CVE-2022-1838: Home Clean Services Management System login.php sql injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-05-24 · updated 2026-06-17
Weakness: CWE-89

Description

A vulnerability classified as critical has been found in Home Clean Services Management System 1.0. This affects an unknown part of admin/login.php. The manipulation of the argument username with the input admin%'/**/AND/**/(SELECT/**/5383/**/FROM/**/(SELECT(SLEEP(5)))JPeh)/**/AND/**/'frfq%'='frfq leads to sql injection. It is possible to initiate the attack remotely but it requires authentication. Exploit details have been disclosed to the public.

Affected products

Home Clean Services Management System: 1.0

References

https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Home%20Clean%20Services%20Management%20System/HCS_admin_SQL_Inject.md
https://vuldb.com/?id.200583
https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Home%20Clean%20Services%20Management%20System/HCS_admin_SQL_Inject.md
https://vuldb.com/?id.200583

Get alerted when CVE-2022-1838 or the next vulnerability affects your stack