Security readout for executives and security teams
Plain-English summary
This CVE describes a SQL injection flaw in Directory Management System v1.0. A search input can reportedly reach database queries unsafely. The public record does not provide CVSS, vendor ownership, affected CPEs, or an official fix, so urgency depends on whether this exact software is deployed and internet-facing.
Executive priority
Treat this as a targeted exposure check, not a confirmed enterprise-wide emergency. If the application is present and externally accessible, prioritize containment and vendor guidance because SQL injection can threaten database confidentiality and integrity.
Technical view
CVE-2022-31382 is reported as SQL injection through the searchdata parameter in search-dirctory.php for Directory Management System v1.0. The source bundle includes a public PoC reference but no CVSS vector, CWE assignment, official advisory, patch details, or confirmed affected vendor metadata.
Likely exposure
Likely limited to organizations running Directory Management System v1.0, especially if search-dirctory.php is reachable from untrusted networks. The CVE metadata does not identify a vendor, CPE, package ecosystem, or broader product family.
Exploitation context
The CVE is not listed as KEV in the provided bundle. A public PoC reference exists, but the supplied evidence does not establish active exploitation, exploitation scale, authentication requirements, or whether the vulnerable route is commonly exposed.
Researcher notes
Evidence is sparse: the CVE record gives the parameter and file, and the only listed reference is a public PoC. No official patch, CVSS, CWE, CPE, authentication context, or exploit-in-the-wild confirmation is provided in the bundle.
Mitigation direction
- Inventory for Directory Management System v1.0 deployments.
- Check vendor or project guidance for a fixed version or mitigation.
- Restrict untrusted access to the affected search route where possible.
- If internally maintained, review SQL handling for parameterized queries.
- Monitor web logs for unusual search activity.
Validation and detection
- Confirm whether search-dirctory.php exists in deployed instances.
- Identify uses of the searchdata parameter in application code.
- Review asset records for Directory Management System v1.0.
- Check public exposure of the affected application route.
- Review logs without replaying public PoC payloads.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-31382 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/laotun-s/POC/blob/main/CVE-2022-31382.txtCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.