CVE-2021-37291

CRITICALNuclei

kevinlab 4st_l-bems Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2021-37291 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the input_id POST parameter in index.php.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 13, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

4st_l-bems

Browse kevinlab / 4st_l-bems
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALKevinLAB BEMS 1.0 - SQL InjectionCVSS 9.8

KevinLAB BEMS 1.0 contains a SQL injection vulnerability. Input passed through input_id POST parameter in /http/index.php is not properly sanitized before being returned to the user or used in SQL queries. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.

Impact

Unauthenticated attackers can exploit SQL injection in the input_id parameter to extract sensitive database contents, modify data, and execute unauthorized administrative operations.

Remediation

Upgrade to KevinLAB BEMS version 1.0.1 or later that addresses the SQL injection vulnerability.

WeaknessesCWE-89
Authorsgy741
Template tagscvecve2021kevinlabsqliedbpacketstormvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:kevinlab:4st_l-bems:1.0.0:*:*:*:*:*:*:*
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5655.php https://www.exploit-db.com/exploits/50146 https://packetstormsecurity.com/files/163572/ https://nvd.nist.gov/vuln/detail/cve-2021-37291

Source: ProjectDiscovery

References

3