PT-2022-10653 · Grandcom · Grandcom Dynweb

Martin Kubecka · Published 2022-05-19 · Updated 2022-06-01 · CVE-2021-37413

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GRANDCOM DynWEB versions prior to 4.2

Description The issue allows a remote unauthenticated attacker to exploit a SQL Injection vulnerability in the admin login interface. This can lead to obtaining administrative access to the webpage, accessing the user database, modifying web content, and uploading custom files. The backend login script fails to verify and sanitize user-provided strings, such as username and password.

Recommendations For GRANDCOM DynWEB versions prior to 4.2, update to version 4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin login interface to minimize the risk of exploitation. Additionally, avoid using unsanitized user input in the backend login script until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-37413

Affected Products

Grandcom Dynweb

References · 6

• 🔥 https://github.com/martinkubecka/CVE-References/blob/main/CVE-2021-37413.md · Exploit
• https://osv.dev/vulnerability/CVE-2021-37413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37413 · Security Note
• https://grandcom.sk · Note
• https://t.me/cibsecurity/42982 · Telegram Post
• https://t.me/cvenotify/30458 · Telegram Post