TI-2022-10185 Aliases CVE-2022-26959 GHSA-r9xm-6r9g-xgp9

There are two full (read/write) Blind/Time-based SQL injection vulnerabilities in the…

MEDIUM 45CWE-89Published 2022-09-16 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

There are two full (read/write) Blind/Time-based SQL injection vulnerabilities in the Northstar Club Management version 6.3 application. The vulnerabilities exist in the userName parameter of the processlogin.jsp page in the /northstar/Portal/ directory and the userID parameter of the login.jsp page in the /northstar/iphone/ directory. Exploitation of the SQL injection vulnerabilities allows full access to the database which contains critical data for organization’s that make full use of the software suite.

Why it matters now

EPSS 0.00931 60th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:globalnorthstar:northstar_club_management:6.3:::::::*	6.3	Vulnerable	Globalnorthstar

cpe:2.3:a:globalnorthstar:northstar_club_management:6.3:*:*:*:*:*:*:* Versions 6.3 Vulnerable ·Globalnorthstar

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-26959
2026-10-03 Alias added: GHSA-r9xm-6r9g-xgp9

References

Exploit 1

https://assura.atlassian.net/wiki/spaces/VULNS/pages/1842675717/CVE-2022-26959+Northstar+Club+Management+software+version+6.3+-+Full+Blind+Time-based+SQL+Injection

Other 1

https://www.assurainc.com/services/advisory-services/threat-vuln-assessment/

TI-2021-10124 Remote Code Execution in cominput.jsp and comoutput.jsp in Northstar Technologies Inc… CVSS 3.1CRITICAL 9.8
TI-2021-10127 Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3… CVSS 3.1CRITICAL 9.8
TI-2021-10126 Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc… CVSS 3.1HIGH 7.5
TI-2021-10128 Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in… CVSS 3.1HIGH 7.5
TI-2021-10125 Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc… CVSS 3.1MEDIUM 6.5
TI-2021-10129 Directory traversal in /northstar/Common/NorthFileManager/fileManagerObjects.jsp… CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences