CVE-2021-41648

HIGHNuclei

PuneethReddyHC action.php SQL Injection

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-41648 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter. Using a post request does not sanitize the user input.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

Proofs of concept

1

Repository PoCs

GitHubMobiusBinary/CVE-2021-41648Repository PoCby MobiusBinary0Not analyzed1 file

1.6 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHPuneethReddyHC action.php SQL InjectionCVSS 7.5

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping through the /action.php prId parameter. Using a post request does not sanitize the user input.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Upgrade to the latest version to mitigate this vulnerability.

WeaknessesCWE-89
Authorsdaffainfo
Template tagscve2021cvesqlipacketstormonline-shopping-system-advanced_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:online-shopping-system-advanced_project:online-shopping-system-advanced:-:*:*:*:*:*:*:*
https://github.com/MobiusBinary/CVE-2021-41648 https://awesomeopensource.com/project/PuneethReddyHC/online-shopping-system https://nvd.nist.gov/vuln/detail/CVE-2021-41649 http://packetstormsecurity.com/files/165036/PuneethReddyHC-Online-Shopping-System-Advanced-1.0-SQL-Injection.html https://github.com/nu11secur1ty/Windows10Exploits

Source: ProjectDiscovery

References

6