PT-2021-15558 · Flatcore · Flatcore

Published 2021-01-15 · Updated 2021-01-22 · CVE-2021-23837

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: flatCore versions prior to 2.0.0 build 139

Description: A time-based blind SQL injection issue was identified in the selected folder HTTP request body parameter for the acp interface. This parameter, which retrieves the file contents of the specified folder, was found to be accepting malicious user input without proper sanitization, leading to SQL injection. As a result, database-related information can be successfully retrieved.

Recommendations: For versions prior to 2.0.0 build 139, consider disabling the selected folder parameter in the acp interface until a patch is available. Restrict access to the acp interface to minimize the risk of exploitation. Avoid using the selected folder parameter in the affected HTTP request body until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-23837

Affected Products

Flatcore

References · 9

• 🔥 http://packetstormsecurity.com/files/160936/flatCore-CMS-XSS-File-Disclosure-SQL-Injection.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-23837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23837 · Security Note
• https://github.com/flatCore/flatCore-CMS · Note
• https://t.me/cvenotify/8563 · Telegram Post
• https://sec-consult.com/vulnerability-lab · Note
• https://t.me/cvenotify/8873 · Telegram Post
• https://t.me/cibsecurity/22199 · Telegram Post
• https://t.me/cvenotify/8584 · Telegram Post