CVE-2022-3059: Schoolbox

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

The application was vulnerable to multiple instances of SQL injection (authenticated and unauthenticated) through a vulnerable parameter. Due to the stacked query support, complex SQL commands could be crafted and injected into the vulnerable parameter and using a sleep based inferential SQL injection it was possible to extract data from the database.

Affected products

• Schoolbox Schoolbox: version 21.0.2 only

Published 2022-10-31. Last modified 2026-06-17.