CVE-2021-3262

Опубликовано: 29 авг. 2023

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

TripSpark VEO Transportation-2.2.x-XP_BB-20201123-184084 NovusEDU-2.2.x-XP_BB-20201123-184084 allows unsafe data inputs in POST body parameters from end users without sanitizing using server-side logic. It was possible to inject custom SQL commands into the "Student Busing Information" search queries.

Ссылки

http://tripspark.com
Product
http://veo.com
Broken Link
https://susos.co/blog/f/cve-disclosureuncovered-sql-injection-in-tripspark-veo-transport
Exploit
Third Party Advisory
http://tripspark.com
Product
http://veo.com
Broken Link
https://susos.co/blog/f/cve-disclosureuncovered-sql-injection-in-tripspark-veo-transport
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:trispark:novusedu:2.2.x-xp_bb-20201123-184084:*:*:*:*:*:*:*

cpe:2.3:a:trispark:veo_transportation:2.2.x-xp_bb-20201123-184084os:*:*:*:*:*:*:*

EPSS

Процентиль: 27%

0.00097

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-89

Связанные уязвимости

GHSA-9hqp-4cqc-x83x