CVE-2021-41649

CRITICALNuclei

online-shopping-system-advanced_project online-shopping-system-advanced Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2021-41649 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 22, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

online-shopping-system-advanced

Browse online-shopping-system-advanced_project / online-shopping-system-advanced
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALPuneethReddyHC Online Shopping System homeaction.php SQL InjectionCVSS 9.8

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Upgrade to the latest version to mitigate this vulnerability.

WeaknessesCWE-89
Authorsdaffainfo
Template tagscve2021cvesqliinjectiononline-shopping-system-advanced_projectvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:online-shopping-system-advanced_project:online-shopping-system-advanced:-:*:*:*:*:*:*:*
https://github.com/MobiusBinary/CVE-2021-41649 https://awesomeopensource.com/project/PuneethReddyHC/online-shopping-system https://nvd.nist.gov/vuln/detail/CVE-2021-41649 https://github.com/ARPSyndicate/cvemon https://github.com/Offensive-Penetration-Security/OPSEC-Hall-of-fame

Source: ProjectDiscovery

References

5