Lucene search

MitreCVE-2021-42169

HistoryOct 22, 2021 - 2:15 p.m.

CVE-2021-42169

2021-10-2214:15:08

CWE-89

mitre

web.nvd.nist.gov

cve-2021-42169

nvd

php

sqlite

security

sql injection

authentication

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.013

Percentile

86.0%

JSON

The Simple Payroll System with Dynamic Tax Bracket in PHP using SQLite Free Source Code (by: oretnom23 ) is vulnerable from remote SQL-Injection-Bypass-Authentication for the admin account. The parameter (username) from the login form is not protected correctly and there is no security and escaping from malicious payloads.

Affected configurations

Nvd

Node

simple_payroll_system_with_dynamic_tax_bracket_projectsimple_payroll_system_with_dynamic_tax_bracketMatch1.0

VendorProductVersionCPE
simple_payroll_system_with_dynamic_tax_bracket_projectsimple_payroll_system_with_dynamic_tax_bracket1.0cpe:2.3:a:simple_payroll_system_with_dynamic_tax_bracket_project:simple_payroll_system_with_dynamic_tax_bracket:1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
simple_payroll_system_with_dynamic_tax_bracket_project	simple_payroll_system_with_dynamic_tax_bracket	1.0	cpe:2.3:a:simple_payroll_system_with_dynamic_tax_bracket_project:simple_payroll_system_with_dynamic_tax_bracket:1.0:::::::*

References

github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-21-100521

www.exploit-db.com/exploits/50403

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.013

Percentile

86.0%

JSON

Related for CVE-2021-42169