What’s Vulnerable › Vulnerabilities

CVE-2022-30335

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-09 · updated 2026-06-17
• Weakness: CWE-89

Description

Bonanza Wealth Management System (BWM) 7.3.2 allows SQL injection via the login form. Users who supply the application with a SQL injection payload in the User Name textbox could collect all passwords in encrypted format from the Microsoft SQL Server component.

Affected products

• Wealth Bonanza Wealth Management System: 7.3.2

References

• https://gist.github.com/aliceicl/b2f25f3a0a3ba9973e4977f922d04008
• https://incognitolab.com
• https://www.wealth.co.th/products/bonanza-wealth-management/
• https://gist.github.com/aliceicl/b2f25f3a0a3ba9973e4977f922d04008
• https://incognitolab.com
• https://www.wealth.co.th/products/bonanza-wealth-management/

Get alerted when CVE-2022-30335 or the next vulnerability affects your stack