CVE-2021-39165

HIGHNuclei

Unauthenticated SQL Injection

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-39165 has a selected CVSS score of 8.1 (high); EIP currently links 2 repository PoCs and 1 Nuclei template.

Description

Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <https://github.com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
2
Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Cachet

Browse fiveai / Cachet
CVE List<= 2.3.18affected

cachethq/cachet

Browse Packagist / cachethq/cachet
GitHub AdvisoryThrough 2.3.18affected

Proofs of concept

2

Repository PoCs

GitHubW0rty/CVE-2021-39165Repository PoCby W0rty21Not analyzed3 files

4.3 KiB

GitHub
PoC details
GitHubmanbolq/CVE-2021-39165Repository PoCby manbolq0Not analyzed3 files

4.1 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMCachet <=2.3.18 - SQL InjectionCVSS 6.5

Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <https://github.com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Upgrade Cachet to a version higher than 2.3.18 or apply the necessary patches provided by the vendor.

WeaknessesCWE-287
Authorstess
Template tagstime-based-sqlicvecve2021cachetsqlichachethqvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:chachethq:cachet:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:-1606065523
FOFA: icon_hash=-1606065523
https://www.leavesongs.com/PENETRATION/cachet-from-laravel-sqli-to-bug-bounty.html https://github.com/fiveai/Cachet/commit/27bca8280419966ba80c6fa283d985ddffa84bb6 https://github.com/W0rty/CVE-2021-39165/blob/main/exploit.py https://nvd.nist.gov/vuln/detail/CVE-2021-39165 https://github.com/fiveai/Cachet/security/advisories/GHSA-79mg-4w23-4fqc

Source: ProjectDiscovery

References

3