Read the docs
TI-2022-17407 Aliases CVE-2022-37333GHSA-p74q-2pf8-j5jx

SQL injection in Kajitori Co.,Ltd Exment

Priority MEDIUM 41CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

SQL injection vulnerability in the Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows remote authenticated attackers to execute arbitrary SQL commands.

Why it matters now

EPSS 0.01444 73rd percentileScored 2026-11-07
Fix Fixed exceedone/exment (Packagist): 5.0.3, 4.4.3exceedone/laravel-admin (Packagist): 2.2.3, 3.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Kajitori Co.,LtdExment(PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier—No fix listedCNA
—exceedone/exment (Packagist)5.0.0 to before 5.0.35.0.3Patch availableGHSA-p74q-2pf8-j5jx
—exceedone/exment (Packagist)before 4.4.34.4.3Patch availableGHSA-p74q-2pf8-j5jx
—exceedone/laravel-admin (Packagist)before 2.2.32.2.3Patch availableGHSA-p74q-2pf8-j5jx
—exceedone/laravel-admin (Packagist)3.0.0 to before 3.0.13.0.1Patch availableGHSA-p74q-2pf8-j5jx
  • Exment VendorKajitori Co.,Ltd Affected (PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier Fixed in — No fix listed CNA
  • exceedone/exment (Packagist) Vendor— Affected 5.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-p74q-2pf8-j5jx
  • exceedone/exment (Packagist) Vendor— Affected before 4.4.3 Fixed in 4.4.3 Patch available GHSA-p74q-2pf8-j5jx
  • exceedone/laravel-admin (Packagist) Vendor— Affected before 2.2.3 Fixed in 2.2.3 Patch available GHSA-p74q-2pf8-j5jx
  • exceedone/laravel-admin (Packagist) Vendor— Affected 3.0.0 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-p74q-2pf8-j5jx

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:exceedone:exment:*:*:*:*:*:*:*:*up to 5.0.2VulnerableKajitori Co.,Ltd
cpe:2.3:a:exceedone:laravel-admin:*:*:*:*:*:*:*:*up to 3.0.0VulnerableKajitori Co.,Ltd
  • cpe:2.3:a:exceedone:exment:*:*:*:*:*:*:*:* Versions up to 5.0.2 Vulnerable ·Kajitori Co.,Ltd
  • cpe:2.3:a:exceedone:laravel-admin:*:*:*:*:*:*:*:* Versions up to 3.0.0 Vulnerable ·Kajitori Co.,Ltd

Remediation

  • Fix · GHSA-p74q-2pf8-j5jx exceedone/exment (Packagist) Fixed in 5.0.3 Advisory →
  • Fix · GHSA-p74q-2pf8-j5jx exceedone/exment (Packagist) Fixed in 4.4.3 Advisory →
  • Fix · GHSA-p74q-2pf8-j5jx exceedone/laravel-admin (Packagist) Fixed in 2.2.3 Advisory →
  • Fix · GHSA-p74q-2pf8-j5jx exceedone/laravel-admin (Packagist) Fixed in 3.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-37333
  2. 2026-10-03 Alias added: GHSA-p74q-2pf8-j5jx

References

Patch 2

Advisory 2

Other 1

  • TI-2022-17800 Cross-site scripting in Kajitori Co.,Ltd Exment CVSS 3.1MEDIUM 5.4
  • TI-2022-17793 Cross-site scripting in Kajitori Co.,Ltd Exment CVSS 3.1MEDIUM 5.4
  • TI-2020-04587 Cross-site scripting in Kajitori Co.,Ltd Exment CVSS 3.1MEDIUM 5.4
  • TI-2020-04588 Cross-site scripting in Kajitori Co.,Ltd Exment CVSS 3.1MEDIUM 5.4
  • TI-2024-32063 Cross-site scripting in Kajitori Co.,Ltd Exment CVSS 3.1MEDIUM 5.4
  • TI-2024-31309 Incorrect permission assignment in Kajitori Co.,Ltd Exment CVSS 3.1LOW 3.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences