CVE-2021-41649

Опубликовано: 01 окт. 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Критический

Описание

An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.

Ссылки

https://awesomeopensource.com/project/PuneethReddyHC/online-shopping-system
Product
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41649
Exploit
Third Party Advisory
https://streamable.com/aii806
Exploit
Third Party Advisory
https://streamable.com/mnn7dn
Exploit
Third Party Advisory
https://awesomeopensource.com/project/PuneethReddyHC/online-shopping-system
Product
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41649
Exploit
Third Party Advisory
https://streamable.com/aii806
Exploit
Third Party Advisory
https://streamable.com/mnn7dn
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:online-shopping-system-advanced_project:online-shopping-system-advanced:-:*:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.9066

Критический

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-2wch-qhpr-mqp5

github

больше 3 лет назад