Lucene search

MitreCVE-2021-44599

HistoryDec 23, 2021 - 1:15 p.m.

CVE-2021-44599

2021-12-2313:15:10

CWE-89

mitre

web.nvd.nist.gov

cve-2021-44599

sql injection

security vulnerability

online enrollment management system 1.0

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

60.0%

JSON

The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks. A crafted payload injects a SQL sub-query that calls MySQL’s load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed. The attacker can retrieve sensitive information for all users of this system.

Affected configurations

Nvd

Node

online_enrollment_management_system_projectonline_enrollment_management_systemMatch1.0

VendorProductVersionCPE
online_enrollment_management_system_projectonline_enrollment_management_system1.0cpe:2.3:a:online_enrollment_management_system_project:online_enrollment_management_system:1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
online_enrollment_management_system_project	online_enrollment_management_system	1.0	cpe:2.3:a:online_enrollment_management_system_project:online_enrollment_management_system:1.0:::::::*

References

github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/Online-Enrollment-Management-System

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

60.0%

JSON

Related for CVE-2021-44599