PT-2022-11271 · Sourcecodester · Sourcecodester Online Dj Management System

Published 2022-01-21 · Updated 2022-01-26 · CVE-2021-40595

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Online Leave Management System version v1

Description The issue allows attackers to execute arbitrary SQL commands via the username parameter to the "/leave system/classes/Login.php" API endpoint. This enables attackers to manipulate the database, potentially leading to unauthorized data access or modification.

Recommendations For Sourcecodester Online Leave Management System version v1, consider restricting access to the "/leave system/classes/Login.php" API endpoint until a patch is available, and avoid using the username parameter in this endpoint to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-40595

Affected Products

Sourcecodester Online Dj Management System

References · 5

• 🔥 https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-03 · Exploit
• https://sourcecodester.com/php/14910/online-leave-management-system-php-free-source-code.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40595 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40595 · Security Note
• https://t.me/cibsecurity/36047 · Telegram Post