PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-2808 Algan Software CVE debrief

CVE-2022-2808 is a high-severity authorization bypass vulnerability in Algan Software's Prens Student Information System, published by NVD on 2022-12-02 and last modified on 2026-05-20. The flaw, classified as CWE-639 (Authorization Bypass Through User-Controlled Key), enables Object Relational Mapping (ORM) injection attacks. Affected versions span all releases prior to 2.1.11. The CVSS 3.1 score of 8.8 reflects network attack vector, low attack complexity, low privileges required, and high impact across confidentiality, integrity, and availability. Turkish cybersecurity authorities (USOM) issued advisory TR-22-0708 documenting this vulnerability. No known exploitation in ransomware campaigns has been recorded, and the vulnerability does not appear on CISA's Known Exploited Vulnerabilities catalog.

Vendor
Algan Software
Product
Prens Student Information System
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2022-12-02
Original CVE updated
2026-05-20
Advisory published
2022-12-02
Advisory updated
2026-05-20

Who should care

Organizations operating Prens Student Information System deployments; educational institutions using affected versions; security teams responsible for student data protection; compliance officers managing educational data privacy requirements

Technical summary

The vulnerability stems from improper authorization controls where user-supplied keys can manipulate ORM queries. Attackers with low privileges can exploit this to bypass intended access restrictions and inject malicious ORM operations, potentially leading to unauthorized data disclosure, modification, or deletion. The attack requires no user interaction and can be executed remotely over the network.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Prens Student Information System to version 2.1.11 or later
  • Review application authorization logic for user-controlled key vulnerabilities
  • Implement input validation and parameterized queries to prevent ORM injection
  • Monitor for unauthorized data access attempts in application logs
  • Conduct security assessment of ORM query construction patterns

Evidence notes

Vendor identification derived from NVD CPE data with medium confidence. CWE-639 classification confirmed by both USOM and NVD sources. Version boundary (before 2.1.11) established through CPE criteria.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-2808 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-2808

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-2808 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-2808

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.