CVE-2021-47956

HIGH

EgavilanMedia PHPCRUD 1.0 SQL Injection via firstname

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-47956. PoCs published by Dimitrios Mitakos.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in EgavilanMedia PHPCRUD 1.0 via the 'firstname' parameter. It provides a step-by-step guide using Burp Suite and sqlmap to exploit the vulnerability and dump the database.

Description

EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the firstname parameter. Attackers can send POST requests to insert.php with malicious firstname values to extract sensitive database information.

Exploits (1)

exploitdb WORKING POC
by Dimitrios Mitakos · textwebappsphp
https://www.exploit-db.com/exploits/49878

This exploit demonstrates a SQL injection vulnerability in EgavilanMedia PHPCRUD 1.0 via the 'firstname' parameter. It provides a step-by-step guide using Burp Suite and sqlmap to exploit the vulnerability and dump the database.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: EgavilanMedia PHPCRUD 1.0
No auth needed
Prerequisites: Burp Suite · sqlmap · access to the vulnerable web application
devstral-2 · analyzed May 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit exploit
ExploitDB-49878
https://www.exploit-db.com/exploits/49878
Product product
Official Product Homepage
https://egavilanmedia.com
Third Party Advisory third-party-advisory
VulnCheck Advisory: EgavilanMedia PHPCRUD 1.0 SQL Injection via firstname
https://www.vulncheck.com/advisories/egavilanmedia-phpcrud-sql-injection-via-firstname

Scores

CVSS v3 8.2
EPSS 0.0028
EPSS Percentile 19.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
Egavilanmedia/EgavilanMedia PHPCRUD 1.0
Published May 16, 2026
Tracked Since May 16, 2026