PT-2022-11824 · Unknown · Mumara Classic

Shain L · Published 2022-08-25 · Updated 2022-08-31 · CVE-2021-43329

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mumara Classic versions through 2.93

Description A SQL injection issue in the license update.php file allows a remote unauthenticated attacker to execute arbitrary SQL commands via the license parameter. This enables the attacker to manipulate database queries, potentially leading to unauthorized data access or modification.

Recommendations For Mumara Classic versions through 2.93, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the license update.php file to minimize the risk of exploitation. Avoid using the license parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-43329

Affected Products

Mumara Classic

References · 12

• 🔥 https://gen.net.uk/about-us/news/50-exploit-db/18335-webapps-mumara-classic-293-license-sql-injection-unauthenticated · Exploit
• 🔥 https://packetstormsecurity.com/files/164947/Mumara-Classic-2.93-SQL-Injection.html · Exploit
• 🔥 https://vulners.com/zdt/1337DAY-ID-37036 · Exploit
• 🔥 https://packetstormsecurity.com/files/164947/mumaraclassic293-sql.txt · Exploit
• 🔥 https://cyberdetails.org/2021/11/mumara-classic-293-sql-injection.html · Exploit
• 🔥 https://linkedin.com/posts/shain-lakin_mumara-classic-293-license-sql-injection-activity-6867380934908506112-dAJd · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2021110057 · Exploit
• 🔥 https://exploit-db.com/exploits/50518 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-43329 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43329 · Vendor Advisory
• https://t.me/cvenotify/35180 · Telegram Post
• https://mumara.com/classic · Note