CVE-2021-25899

HIGHNuclei

void aurall_rec_monitor Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2021-25899 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. An unauthenticated attacker can send a crafted HTTP request to perform a blind time-based SQL Injection. The vulnerable parameter is param1.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 22, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

aurall_rec_monitor

Browse void / aurall_rec_monitor
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHVoid Aural Rec Monitor 9.0.0.1 - SQL InjectionCVSS 7.5

Void Aural Rec Monitor 9.0.0.1 contains a SQL injection vulnerability in svc-login.php. An attacker can send a crafted HTTP request to perform a blind time-based SQL injection via the param1 parameter and thus possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in Void Aural Rec Monitor 9.0.0.1.

WeaknessesCWE-89
Authorsedoardottt
Template tagstime-based-sqlicve2021cvesqlivoidaurallvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:void:aurall_rec_monitor:9.0.0.1:*:*:*:*:*:*:*
Shodan: html:"AURALL"
Shodan: http.html:"aurall"
FOFA: body="aurall"
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/all-your-databases-belong-to-me-a-blind-sqli-case-study/ https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28765 https://nvd.nist.gov/vuln/detail/CVE-2021-25899 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3