PT-2021-24209 · Unknown · Simple Forum-Discussion System

Published 2021-12-21 · Updated 2023-10-18 · CVE-2021-45252

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Simple Forum-Discussion System version 1.0

Description: The issue affects the Simple Forum-Discussion System, allowing an attacker to retrieve all information from the database. This is possible due to multiple SQL injection vulnerabilities found in applications such as manage topic.php, manage user.php, and ajax.php.

Recommendations: For Simple Forum-Discussion System version 1.0, consider disabling the manage topic.php, manage user.php, and ajax.php applications until a patch is available to prevent exploitation of the SQL injection vulnerabilities. Restrict access to these vulnerable components to minimize the risk of information retrieval from the database.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-45252

Affected Products

Simple Forum-Discussion System

References · 4

• 🔥 https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/Forum-Discussion-System-1.0 · Exploit
• https://osv.dev/vulnerability/CVE-2021-45252 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45252 · Security Note
• https://t.me/cibsecurity/34425 · Telegram Post