PT-2022-10074 · Viavi · Viaviwebtech Android Ebook App

Veyselxan · Published 2022-06-30 · Updated 2022-07-12 · CVE-2021-32428

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions viaviwebtech Android EBook App version 10

Description The issue is related to a SQL Injection vulnerability. It can be exploited via the author id parameter to the "api.php" endpoint.

Recommendations For version 10, avoid using the author id parameter in the "api.php" endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the "api.php" endpoint to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-32428

Affected Products

Viaviwebtech Android Ebook App

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-32428 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32428 · Vendor Advisory
• https://owasp.org/www-community/attacks/Blind_SQL_Injection · Note
• https://t.me/cvenotify/32450 · Telegram Post
• https://t.me/cvenotify/32467 · Telegram Post
• https://veysel-xan.com/CVE-2021-32428.txt · Note
• https://codecanyon.net/item/android-ebook-app-with-material-design/21680614 · Note
• https://codecanyon.net/user/viaviwebtech · Note