PT-2021-23640 · Unknown · Sourcecodester Online Learning System

Oretnom23 · Published 2021-11-15 · Updated 2024-12-18 · CVE-2021-42580

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Online Learning System version 2.0

Description The issue concerns SQL injection authentication bypass in the admin login file (/admin/login.php) and authenticated file upload in the (Master.php) file. These vulnerabilities can be exploited to achieve unauthenticated remote command execution.

Recommendations For Sourcecodester Online Learning System version 2.0, consider disabling the /admin/login.php and Master.php files until a patch is available to prevent SQL injection and file upload exploitation. Restrict access to these files to minimize the risk of unauthenticated remote command execution.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-42580

Affected Products

Sourcecodester Online Learning System

References · 12

• 🔥 https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-07 · Exploit
• 🔥 https://exploit-db.com/exploits/50526 · Exploit
• 🔥 http://packetstormsecurity.com/files/164985/Online-Learning-System-2.0-Remote-Code-Execution.html · Exploit
• 🔥 https://nu11secur1ty.com/2021/11/cve-2021-42580.html · Exploit
• 🔥 https://nu11secur1ty.com/2021/09/cve-nu11-07-elearning-v2by-oretnom23-is.html · Exploit
• 🔥❌ https://github.com/DjebbarAnon/online-learning-system-v2-sqli-authentication-bypass-file-upload-unauthenticated-RCE · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2021-42580 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42580 · Security Note
• https://t.me/cvenotify/23798 · Telegram Post
• https://t.me/cvenotify/23657 · Telegram Post
• https://t.me/cvenotify/104742 · Telegram Post
• https://t.me/cibsecurity/32469 · Telegram Post