PT-2021-23649 · Unknown · Sourcecodester Engineers Online Portal

0Xdeku + 1 · Published 2021-11-05 · Updated 2021-12-16 · CVE-2021-42668

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sourcecodester Engineers Online Portal (affected versions not specified)

Description A SQL Injection issue exists in the Sourcecodester Engineers Online Portal in PHP, specifically via the id parameter in the "my classmates.php" web page. This allows an attacker to extract sensitive data from the web server and potentially achieve remote code execution on the remote web server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-42668

Affected Products

Sourcecodester Engineers Online Portal

References · 6

• 🔥 https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-42668 · Exploit
• 🔥 https://github.com/TheHackingRabbi/CVE-2021-42668 · Exploit
• 🔥 https://nu11secur1ty.com/2021/12/cve-2021-42668.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-42668 · Security Note
• https://t.me/cibsecurity/31879 · Telegram Post
• https://sourcecodester.com/php/13115/engineers-online-portal-php.html · Note