CVE-2021-47811
CRITICALgrocery_crud < 2.0.1 - SQL Injection via order_by Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-47811. PoCs published by TonyShavez.
AI-analyzed exploit summary The exploit demonstrates an SQL injection vulnerability in Grocery CRUD versions prior to 2.0.1 via the 'order_by' parameter in an AJAX request. The proof-of-concept shows how an attacker can inject malicious SQL payloads into the 'order_by[]' parameter to manipulate database queries.
Description
Grocery Crud 1.6.4 contains a SQL injection vulnerability in the order_by parameter that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the order_by[] parameter in POST requests to the ajax_list endpoint to potentially extract or modify database information.
Exploits (1)
The exploit demonstrates an SQL injection vulnerability in Grocery CRUD versions prior to 2.0.1 via the 'order_by' parameter in an AJAX request. The proof-of-concept shows how an attacker can inject malicious SQL payloads into the 'order_by[]' parameter to manipulate database queries.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N