PT-2022-11986 · Unknown · Egavilan Media Contact-Form-With-Messages-Entry-Management

Shubhamvpandey · Published 2022-05-31 · Updated 2022-06-08 · CVE-2021-44097

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EGavilan Media Contact-Form-With-Messages-Entry-Management version 1.0

Description The issue allows a remote attacker to compromise the application's SQL database via SQL Injection in the Addmessage.php file. This can be exploited by sending malicious input to the Addmessage.php endpoint, potentially allowing access to sensitive data.

Recommendations For EGavilan Media Contact-Form-With-Messages-Entry-Management version 1.0, consider disabling the Addmessage.php file or restricting access to it until a patch is available to prevent SQL Injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-44097

Affected Products

Egavilan Media Contact-Form-With-Messages-Entry-Management

References · 6

• 🔥 https://github.com/EGavilan-Media/Contact-Form-With-Messages-Entry-Management/issues/1 · Exploit
• 🔥 https://medium.com/@shubhamvpandey/cve-2021-44097-d51c11258571 · Exploit
• https://osv.dev/vulnerability/CVE-2021-44097 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44097 · Security Note
• https://medium.com/%40shubhamvpandey/cve-2021-44097-d51c11258571 · Note
• https://t.me/cibsecurity/43715 · Telegram Post