Division Regional Athletic Meet Game Result Matrix System check-user.php SQL injection

A sports-day results program's database can be stolen remotely.

Summary

An abbr argument in /dipam/check-user.php of Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1 can be manipulated to inject SQL. The attack can be launched remotely, and public exploit code exists.

What to do

We have not confirmed a fixed version yet. Check the source links below.

Products and platforms

Division Regional Athletic Meet Game Result Matrix System

CVE IDs

CVE-2026-122048 (opens in a new tab)

Sources

Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · tracexlabs.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 23:00 UTC

First seen 2026-11-09 16:20 UTC