CVE-2021-42670

CRITICAL

Engineers Online Portal - SQL Injection via Announcements Student ID Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2021-42670. PoCs published by 0xDeku.

AI-analyzed exploit summary This repository provides a proof-of-concept for CVE-2021-42670, an SQL injection vulnerability in the Engineers Online Portal system. The exploit targets the 'id' parameter in 'announcements_student.php' to extract sensitive data, such as the MySQL server version.

Description

A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcements_student.php web page. As a result a malicious user can extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remote web server.

Exploits (2)

nomisec WORKING POC 2 stars
by 0xDeku · poc
https://github.com/0xDeku/CVE-2021-42670

This repository provides a proof-of-concept for CVE-2021-42670, an SQL injection vulnerability in the Engineers Online Portal system. The exploit targets the 'id' parameter in 'announcements_student.php' to extract sensitive data, such as the MySQL server version.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Engineers Online Portal system
No auth needed
Prerequisites: Access to the vulnerable web page 'announcements_student.php'
devstral-2 · analyzed Feb 16, 2026 Full analysis →
inthewild WRITEUP
poc
https://github.com/thehackingrabbi/cve-2021-42670

This repository provides a technical description and proof-of-concept payload for an SQL Injection vulnerability in the Engineers Online Portal system, specifically targeting the 'id' parameter in 'announcements_student.php'. The PoC demonstrates how to extract the MySQL server version using a crafted SQL injection payload.

Classification
Writeup 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Engineers Online Portal system
No auth needed
Prerequisites: Access to the vulnerable web page 'announcements_student.php'
devstral-2 · analyzed Feb 23, 2026 Full analysis →

References (3)

Core 3
Core References
Product, Third Party Advisory x_refsource_misc
https://www.sourcecodester.com/php/13115/engineers-online-portal-php.html
Exploit, Third Party Advisory x_refsource_misc
https://github.com/TheHackingRabbi/CVE-2021-42670

Scores

CVSS v3 9.8
EPSS 0.5803
EPSS Percentile 98.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
engineers_online_portal_project/engineers_online_portal
Published Nov 05, 2021
Tracked Since Feb 18, 2026