Is CVE-2026-122048 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-122048 being exploited in the wild.

How severe is CVE-2026-122048?

High severity, with a CVSS score of 7.3, published 4 November 2026.

Which products and versions are affected?

Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1.

How is CVE-2026-122048 attacked?

It is attacked over the network.

Am I affected by CVE-2026-122048?

Check whether you run Campcodes Division Regional Athletic Meet Game Result Matrix System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-122048: Campcodes Division Regional Athletic Meet SQL injection in check-user.php

CVE-2026-122048 · Severity: high · CVSS 7.3 · Published 2026-11-04

Campcodes Division Regional Athletic Meet is a web-based system for managing athletic competition results. The system contains an unauthenticated SQL injection vulnerability in the check-user.php file that allows attackers to extract sensitive user and athlete data from the database without any credentials. An attacker can remotely exploit this flaw to read confidential information such as athlete records and user credentials.

Vendors: Campcodes.

Quick answers

Is CVE-2026-122048 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-122048 being exploited in the wild.
How severe is CVE-2026-122048?: High severity, with a CVSS score of 7.3, published 4 November 2026.
Which products and versions are affected?: Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1.
Is there a fix for CVE-2026-122048?: No fixed version is recorded yet. Implement authentication checks before the check-user.php script executes any logic, and refactor all database queries to use prepared statements with parameterized queries instead of string concatenation. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-122048 attacked?: It is attacked over the network.
Am I affected by CVE-2026-122048?: Check whether you run Campcodes Division Regional Athletic Meet Game Result Matrix System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Implement authentication checks before the check-user.php script executes any logic, and refactor all database queries to use prepared statements with parameterized queries instead of string concatenation.

Technical details

Unauthenticated blind SQL injection exists in the abbr GET parameter of /dipam/check-user.php, where user input is directly concatenated into a SELECT query against tbl_user without sanitization or parameterized statements. The vulnerability is exploitable remotely with no authentication or user interaction required; attackers can use time-based oracles (SLEEP delays) to exfiltrate data from MariaDB. A public proof-of-concept demonstrates extraction of athlete and user records via boolean and time-based techniques.

Affected products

Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1

Timeline

2026-09-26: disclosed: Vulnerability discovered and validated in local lab environment
2026-11-04: advisory: Advisory published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.