PT-2021-22295 · Unknown · Simple Water Refilling Station Management System

Nu11Secur1Ty · Published 2021-09-07 · Updated 2021-11-28 · CVE-2021-38840

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simple Water Refilling Station Management System version 1.0

Description SQL Injection can occur via the username parameter in the water refilling/classes/Login.php file. This issue allows for potential SQL injection attacks.

Recommendations For Simple Water Refilling Station Management System version 1.0, consider disabling the username parameter in the water refilling/classes/Login.php file until a patch is available. Restrict access to the Login.php file to minimize the risk of exploitation. Avoid using the username parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-38840

Affected Products

Simple Water Refilling Station Management System

References · 9

• 🔥 https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38840 · Exploit
• 🔥 https://exploit-db.com/exploits/50205 · Exploit
• 🔥 https://exploit-db.com/exploits/50204 · Exploit
• https://osv.dev/vulnerability/CVE-2021-38840 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38840 · Security Note
• https://t.me/cibsecurity/28325 · Telegram Post
• https://sourcecodester.com/php/14906/simple-water-refilling-station-management-system-php-free-source-code.html · Note
• https://t.me/cvenotify/22844 · Telegram Post
• https://sourcecodester.com/users/tips23 · Note