PT-2022-11506 · Sourcecodester · Sourcecodester Try My Recipe

Oretnom23 · Published 2022-01-24 · Updated 2022-01-31 · CVE-2021-41928

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) version 1.0

Description The issue allows attackers to execute arbitrary code via the rid parameter to the "view recipe" page. This enables attackers to perform SQL injection attacks, potentially leading to unauthorized access or data manipulation.

Recommendations For version 1.0, consider restricting access to the "view recipe" page or validating and sanitizing the rid parameter to prevent SQL injection attacks. As a temporary workaround, avoid using the rid parameter in the affected page until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-41928

Affected Products

Sourcecodester Try My Recipe

References · 5

• 🔥 https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-17-092921 · Exploit
• https://osv.dev/vulnerability/CVE-2021-41928 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41928 · Security Note
• https://t.me/cibsecurity/36150 · Telegram Post
• https://t.me/cvenotify/26056 · Telegram Post