PT-2022-11832 · Sourcecodester · Sourcecodester Online Payment Hub

Oretnom23 · Published 2022-01-24 · Updated 2022-01-28 · CVE-2021-43420

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Online Payment Hub version 1

Description The issue allows attackers to execute arbitrary SQL commands via the username parameter in the Login.php file. This enables potential unauthorized access and manipulation of database content.

Recommendations For Sourcecodester Online Payment Hub version 1, consider restricting access to the Login.php file until a patch is available. As a temporary workaround, avoid using the username parameter in the affected login functionality to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-43420

Affected Products

Sourcecodester Online Payment Hub

References · 4

• 🔥 https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/oretnom23/CVE-NU11-2021-1101/README.MD · Exploit
• https://osv.dev/vulnerability/CVE-2021-43420 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43420 · Security Note
• https://t.me/cibsecurity/36163 · Telegram Post