CVE-2021-44567

CRITICAL

RosarioSIS < 7.6.1 - Unauthenticated SQL Injection via PortalPollsNotes Votes Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-44567. PoCs published by CodeSecLab.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in RosarioSIS 7.6 via the PortalPollsNotes.fnc.php endpoint. The PoC shows how an attacker can inject malicious SQL payloads through the 'votes' POST parameter to execute arbitrary SQL commands, such as creating a new table.

Description

An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php.

Exploits (1)

exploitdb WORKING POC

by CodeSecLab · textwebappsphp

https://www.exploit-db.com/exploits/52169

View Code ZIP pw:eip

This exploit demonstrates a SQL injection vulnerability in RosarioSIS 7.6 via the PortalPollsNotes.fnc.php endpoint. The PoC shows how an attacker can inject malicious SQL payloads through the 'votes' POST parameter to execute arbitrary SQL commands, such as creating a new table.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: RosarioSIS 7.6

No auth needed

Prerequisites: Network access to the target application · The target application must be running RosarioSIS 7.6

MITRE ATT&CK