CVE-2021-28423

Опубликовано: 01 июл. 2021

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

Multiple SQL Injection vulnerabilities in Teachers Record Management System 1.0 thru 2.1 allow remote authenticated users to execute arbitrary SQL commands via the 'editid' GET parameter in edit-subjects-detail.php, edit-teacher-detail.php, or the 'searchdata' POST parameter in search.php.

Ссылки

https://nhattruong.blog/2021/05/22/cve-2021-28423-teachers-record-management-system-1-0-searchdata-error-based-sql-injection-authenticated/
Exploit
Third Party Advisory
https://packetstormsecurity.com/files/163172/Teachers-Record-Management-System-1.0-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql/
Product
https://www.exploit-db.com/exploits/50018
Exploit
Third Party Advisory
VDB Entry
https://nhattruong.blog/2021/05/22/cve-2021-28423-teachers-record-management-system-1-0-searchdata-error-based-sql-injection-authenticated/
Exploit
Third Party Advisory
https://packetstormsecurity.com/files/163172/Teachers-Record-Management-System-1.0-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql/
Product
https://www.exploit-db.com/exploits/50018
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:phpgurukul:teachers_record_management_system:1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 82%

0.01718

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-w463-hpv4-95pw