Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-37808

SQL Injection vulnerabilities exist in https://phpgurukul.com News Portal Project 3.1 via the (1) category, (2) subcategory, (3) sucatdescription, and (4) username parameters, the server response is about (N) seconds delay respectively which mean it is vulnerable to MySQL Blind (Time Based). An attacker can use sqlmap to further the exploitation for extracting sensitive information from the database.

Published

2021-10-27T17:15:10.713

Last Modified

2024-11-21T06:15:55.930

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-89

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	phpgurukul	news_portal	3.1	Yes

References

https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-37808 Exploit, Third Party Advisory ([email protected])
https://packetstormsecurity.com/files/163575/News-Portal-Project-3.1-SQL-Injection.html Third Party Advisory, VDB Entry ([email protected])
https://www.nu11secur1ty.com/2021/12/cve-2021-37808.html Exploit, Third Party Advisory ([email protected])
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-37808 Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://packetstormsecurity.com/files/163575/News-Portal-Project-3.1-SQL-Injection.html Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://www.nu11secur1ty.com/2021/12/cve-2021-37808.html Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)