CVE-2021-37538

CRITICALNuclei

smartdatasoft smartblog Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2021-37538 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controllers/front/archive.php archive controller, or the id_category parameter to the controllers/front/category.php category controller.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 11, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

smartblog

Browse smartdatasoft / smartblog
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALPrestaShop SmartBlog <4.0.6 - SQL InjectionCVSS 9.8

PrestaShop SmartBlog by SmartDataSoft < 4.0.6 is vulnerable to a SQL injection vulnerability in the blog archive functionality.

Impact

An attacker can gain unauthorized access to the database, extract sensitive information, modify data, or perform other malicious activities.

Remediation

Upgrade PrestaShop SmartBlog to version 4.0.6 or later to mitigate the SQL Injection vulnerability.

WeaknessesCWE-89
Authorswhoever
Template tagscve2021cveprestashopsmartblogsqlismartdatasoftvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:smartdatasoft:smartblog:*:*:*:*:*:prestashop:*:*
https://blog.sorcery.ie/posts/smartblog_sqli/ https://nvd.nist.gov/vuln/detail/CVE-2021-37538 https://classydevs.com/free-modules/smartblog/ https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3