CVE-2022-50892 is a SQL injection in the login page of VIAVIWEB Wallpaper Admin 1.0, scored 8.2 (high). It lets a visitor bypass authentication and reach the administrative interface. The record names no fixed version, so block public access to the admin panel and ask the vendor for a patch.
What's affected
The record lists VIAVIWEB Wallpaper Admin 1.0. The login page builds its credential check with unsafe input handling, which lets an attacker skip the password check and sign in to the administrative interface.
The CVSS vector is AV:N/AC:L/PR:N/UI:N. No fixed release is named in the record. The references are the vendor site and a public Exploit-DB entry.
How to check if you're exposed
This is a purchased script, not a package, so check manually.
- Confirm whether your organization or a client runs a Wallpaper Admin panel from VIAVIWEB.
- Review the admin login logs for sign ins that do not match your administrators, especially from unfamiliar addresses.
- Check the application content, such as wallpapers, categories and settings, for unexpected changes.
- Confirm whether the admin path is open to the internet.
What to do now
- Put the admin panel behind a VPN, IP allowlist or HTTP basic authentication at the web server.
- Check the vendor site for an updated release. The record does not name one.
- Review recent admin activity and content for tampering.
- Rotate the admin password and any API keys the panel holds.
- Rewrite the login query to use prepared statements if you maintain the code.
Why it matters
The weakness is CWE-89, SQL injection. The application builds a database query by putting request data straight into the query text. The database cannot tell which part is the developer's instruction and which part came from the visitor, so crafted input can change what the query does.
This is an authentication bypass through SQL injection. The login check is itself the query being attacked, so the attacker never needs a valid password. Once inside, they act as an administrator, which is a larger problem than reading data. A login form is also the one page every visitor is expected to reach.
The fix for this class is well understood. Use parameterized queries or prepared statements so that input is always treated as data, validate values against an allowlist where only a few are valid, and give the application database account only the rights it needs. None of this is complicated, but it has to be applied to every query in the code base, which is why one reported parameter is often a sign of others.
Quick check
Why is login injection worse than a read only flaw?
Because it grants administrator access. The attacker can then change content and settings, not only read data.
Sources
Last reviewed: 19 October 2026.
