External risk intelligence

SCBS Online Sports Venue Reservation System Local File Inclusion Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-28093

This is a web-based reservation system application designed for public-facing use, such as booking sports venues. Such systems are typically deployed as internet-accessible web services to allow users to register, view schedules, and make reservations online.

Online Sports Complex Booking System Project Online Sports Complex Booking System

1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in an online sports venue reservation system could allow unauthorized individuals to execute arbitrary code on affected systems. This type of vulnerability is critical as it could potentially lead to a compromise of the system's integrity and the confidentiality of any data it holds. The main concern at this time is to confirm if this system is in use and exposed.

System flaw allows code execution.
Potential for system compromise exists.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the web application. This would allow them to include arbitrary PHP files, leading to the execution of malicious code on the server.

No authentication required.
Triggered via crafted web request.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A local file inclusion vulnerability in the SCBS Online Sports Venue Reservation System could allow an attacker to execute arbitrary code. This occurs when a specially crafted PHP file is uploaded, potentially leading to the compromise of the underlying system.

System files and arbitrary code execution.
Uploading a crafted PHP file.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the SCBS Online Sports Venue Reservation System affects a publicly accessible web application. Application owners or platform teams responsible for this system should initiate an inventory to locate all deployments. Once identified, assess their business criticality and network exposure to prioritize remediation efforts, which may involve coordination with vendors if the system is third-party.

Identify system owners and asset locations.
Verify public accessibility and business criticality.
Plan risk-based remediation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Online Sports Complex Booking System?

This software is a web-based reservation platform designed for managing sports venue bookings. It allows users to browse schedules, register, and reserve facilities online. As a PHP and MySQL-based application, it serves as the digital interface between venue administrators and the public, typically running on a web server to handle incoming reservation requests.

What does local file inclusion mean in CVE-2022-28093?

This vulnerability is a type of input handling flaw where the application improperly processes file paths. Instead of only accessing intended files, the system can be tricked into including and executing unauthorized local files. In this specific case, it allows an attacker to inject a crafted PHP file, which the server then interprets and runs as code, effectively giving the attacker control over application functions.

How does an attacker trigger this vulnerability?

An attacker initiates this by sending a specially crafted request to the web application. Because the system does not validate the input, it follows the attacker's instructions to load and execute the malicious file. Simply visiting the site or standard user activity will not trigger the bug; the attacker must intentionally submit specific, malicious input designed to bypass the application's expected file access controls.

Is my system at risk if it is not exposed to the internet?

Halo Surface Signal indicates this software is primarily designed for public-facing use, making internet-accessible instances the highest priority. If your instance is hosted entirely on an internal, isolated network with no outside connectivity, the immediate risk from external network-based attackers is significantly lower. However, internal users or compromised accounts could still potentially interact with the application.

What should I do if I am running this system?

Start by identifying all deployments within your environment to confirm if you are running version 1.0. Once located, assess how these systems are exposed and how critical they are to your daily operations. Since this flaw allows for full system compromise, your primary goal is to determine the business risk and prepare for a transition to a secure configuration or an alternative, supported solution.

References

www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmys…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.