CVE-2021-37808
MEDIUMNews Portal Project 3.1 - SQL Injection via Category Subcategory Sucatdescription Username Parameters
Title source: llmDescription
SQL Injection vulnerabilities exist in https://phpgurukul.com News Portal Project 3.1 via the (1) category, (2) subcategory, (3) sucatdescription, and (4) username parameters, the server response is about (N) seconds delay respectively which mean it is vulnerable to MySQL Blind (Time Based). An attacker can use sqlmap to further the exploitation for extracting sensitive information from the database.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry x_refsource_misc
https://packetstormsecurity.com/files/163575/News-Portal-Project-3.1-SQL-Injection.html
Exploit, Third Party Advisory x_refsource_misc
https://www.nu11secur1ty.com/2021/12/cve-2021-37808.html
Exploit, Third Party Advisory x_refsource_misc
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-37808
Scores
CVSS v3
5.9
EPSS
0.0116
EPSS Percentile
78.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-89
Status
published
Products (1)
phpgurukul/news_portal
3.1
Published
Oct 27, 2021
Tracked Since
Feb 18, 2026