PT-2022-12561 · Xzs-Mysql · Xzs-Mysql

Published 2022-01-25 · Updated 2022-01-31 · CVE-2021-46086

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions xzs-mysql versions t3.4.0 and later

Description The issue concerns an insecure permissions vulnerability in the functional method of submitting examination papers in an online examination system. An attacker can exploit this by modifying parameters in the packet using tools like burp suite to potentially destroy real data.

Recommendations For xzs-mysql versions t3.4.0 and later, consider restricting access to the examination paper submission functionality until a proper fix is applied, and review the system's permissions to ensure they are properly secured.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2021-46086

Affected Products

Xzs-Mysql

References · 4

• 🔥 https://github.com/mindskip/xzs-mysql/issues/327 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-46086 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46086 · Vendor Advisory
• https://t.me/cibsecurity/36238 · Telegram Post