PT-2021-24139 · Unknown · Simple Online Mens Salon Management System

Published 2021-12-23 · Updated 2025-02-11 · CVE-2021-44600

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Simple Online Mens Salon Management System (MSMS) version 1.0

Description: The password parameter appears to be vulnerable to SQL injection attacks, allowing an attacker to retrieve all authentication and information about the users of this system. The predictive tests of this application interacted with the domain, indicating that the injected SQL query was executed.

Recommendations: For Simple Online Mens Salon Management System (MSMS) version 1.0, consider disabling the password parameter until a patch is available to prevent SQL injection attacks. Restrict access to sensitive user information to minimize the risk of exploitation. Avoid using the password parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-44600

Affected Products

Simple Online Mens Salon Management System

References · 5

• 🔥 https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/MSMS · Exploit
• https://osv.dev/vulnerability/CVE-2021-44600 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44600 · Security Note
• https://t.me/cvenotify/110809 · Telegram Post
• https://t.me/cibsecurity/34562 · Telegram Post