CVE-2021-27314

CRITICALNuclei

Doctor Appointment System 1.0 - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-27314 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login page.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryCRITICALDoctor Appointment System 1.0 - SQL InjectionCVSS 9.8

SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login page.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Upgrade to the latest version to mitigate this vulnerability.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicve2021cvesqlidoctor-appointment-systempacketstormdoctor_appointment_system_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:doctor_appointment_system_project:doctor_appointment_system:1.0:*:*:*:*:*:*:*
https://www.sourcecodester.com/php/14182/doctor-appointment-system.html http://packetstormsecurity.com/files/161642/Doctor-Appointment-System-1.0-Blind-SQL-Injection.html https://nvd.nist.gov/vuln/detail/CVE-2021-27314

Source: ProjectDiscovery

References

2