High severity8.2NVD Advisory· Published Oct 22, 2026

CVE-2022-51023

Description

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information through error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Projectdiscovery/Nuclei Templatesllm-fuzzy
Qinggan/Phpokllm-fuzzy
Range: <5.4.081
Phpok/Phpokllm-fuzzy
Range: <5.4.081

Patches

Vulnerability mechanics

References

github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/phpok-sqli.yamlnvd
github.com/qinggan/phpok/commit/d70c396fnvd
www.vulncheck.com/advisories/phpok-5.4.081-sql-injection-via-api-php-sort-parameternvd

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000