Cpe:2.3:a:campcodes:division_regional_athletic_meet_game_result_matrix_system:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3acampcodesdivision_regional_athletic_meet_game_result_matrix_system/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 00:07:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCampcodes Division Regional Athletic Meet Game Result Matrix System: SQL injection (CVE-2026-122048)https://feed.craftedsignal.io/briefs/2026-11-campcodes-sqli/Thu, 05 Nov 2026 00:07:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-campcodes-sqli/A SQL injection vulnerability in the Division Regional Athletic Meet Game Result Matrix System allows remote attackers to execute arbitrary database commands via the abbr parameter in check-user.php.A SQL injection vulnerability (CVE-2026-122048) exists in Campcodes Division Regional Athletic Meet Game Result Matrix System versions 2.1 and earlier. The vulnerability is located in the /dipam/check-user.php script. An attacker can manipulate the abbr parameter to inject malicious SQL commands, enabling unauthorized database access. Exploitation is possible remotely and functional exploit code is publicly available.

Impact

Successful exploitation allows for unauthorized database interaction, which may lead to data exfiltration, modification, or destruction depending on the database user permissions.

Recommendation

  • Inventory all instances of the Campcodes Division Regional Athletic Meet Game Result Matrix System to identify versions 2.1 and earlier.
  • Apply the vendor-provided patch if available, or restrict access to the /dipam/ directory.
  • Monitor web server access logs for anomalous payloads in the 'abbr' parameter of 'check-user.php' requests.
]]>highadvisory