CVE-2021-27124

MEDIUMNuclei

Doctor Appointment System 1.0 - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-27124 has a selected CVSS score of 6.5 (medium); EIP currently links 1 Nuclei template.

Description

SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated patient user to dump the database credentials via a SQL injection attack.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMDoctor Appointment System 1.0 - SQL InjectionCVSS 6.5

SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Upgrade to the latest version to mitigate this vulnerability.

WeaknessesCWE-89
Authorstheamanrawat
Template tagscve2021cvepacketstormsqlidoctor-appointment-systemdoctor_appointment_system_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:doctor_appointment_system_project:doctor_appointment_system:1.0:*:*:*:*:*:*:*
https://www.sourcecodester.com/php/14182/doctor-appointment-system.html https://packetstormsecurity.com/files/161342/Doctor-Appointment-System-1.0-SQL-Injection.html https://nvd.nist.gov/vuln/detail/CVE-2021-27124

Source: ProjectDiscovery

References

4