CVE-2021-30117

The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId. Detailed description --- Given the following request: GET /InstallTab/exportFldr.asp?fldrId=1’ HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 Macintosh;...

CVE-2021-30117: Improper Neutralization of Special Elements used in an SQL Command

The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId. Detailed description --- Given the following request: GET /InstallTab/exportFldr.asp?fldrId=1’ HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 Macintosh;...

PT-2021-7745

Name of the Vulnerable Software and Affected Versions Kaseya VSA versions prior to 9.5.6 Description The issue is related to a semi-authenticated boolean-based blind SQL injection in the fldrId parameter of the /InstallTab/exportFldr.asp API endpoint. This allows a remote attacker to execute...