PT-2021-22294 · Unknown · Phpgurukul Apartment Visitors Management System

Mari0X00 · Published 2021-09-13 · Updated 2021-11-05 · CVE-2021-38833

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPGurukul Apartment Visitors Management System (AVMS) version 1.0

Description The issue allows attackers to execute arbitrary SQL statements and gain remote code execution (RCE) capabilities.

Recommendations For PHPGurukul Apartment Visitors Management System (AVMS) version 1.0, consider implementing input validation and sanitization to prevent SQL injection attacks. As a temporary workaround, restrict access to sensitive database operations until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-38833

Affected Products

Phpgurukul Apartment Visitors Management System

References · 8

• 🔥 https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38833 · Exploit
• 🔥 https://exploit-db.com/exploits/50288 · Exploit
• 🔥 https://streamable.com/ojobew · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-38833 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38833 · Vendor Advisory
• https://phpgurukul.com/apartment-visitors-management-system-using-php-and-mysql · Vendor Advisory
• https://t.me/cibsecurity/28736 · Telegram Post
• https://t.me/cvenotify/22320 · Telegram Post