PT-2026-3172 · Vianeos · Vianeos Octopus 5

Published 2026-01-15 · Updated 2026-01-16 · CVE-2021-47801

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vianeos OctoPUS 5

Description The software contains a time-based blind SQL injection issue in the login user parameter during authentication requests. An attacker can exploit this by sending malicious POST requests with crafted SQL payloads that trigger database sleep functions to extract information. The vulnerable parameter is used during authentication.

Recommendations Apply input validation and sanitization to the login user parameter to prevent the injection of malicious SQL code.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-47801

Affected Products

Vianeos Octopus 5

References · 6

• 🔥 https://exploit-db.com/exploits/50078 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47801 · Security Note
• https://twitter.com/CVEnew/status/2012126490415051089 · Twitter Post
• https://vianeos.com/en/products/octopus · Note
• https://vulncheck.com/advisories/vianeos-octopus-loginuser-sqli · Note
• http://vianeos.com/en/home-vianeos · Note