CVE-2021-27999

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-27999
A SQL injection vulnerability was discovered in the editid parameter in Local Services Search Engine Management System Project 1.0. This vulnerability gives admin users the ability to dump all data from the database.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://medium.com/%40tusharvaidya16/authenticated-blind-error-based-sql-injection-on-local-services-search-engine-management-system-3e99779f0850
https://medium.com/%40tusharvaidya16/authenticated-blind-error-based-sql-injection-on-local-services-search-engine-management-system-3e99779f0850
Configurations

Configuration 1 (hide)

cpe:2.3:a:local_services_search_engine_management_system_project:local_services_search_engine_management_system:1.0:*:*:*:*:*:*:*
History

21 Nov 2024, 05:58

Type Values Removed Values Added
References () https://medium.com/%40tusharvaidya16/authenticated-blind-error-based-sql-injection-on-local-services-search-engine-management-system-3e99779f0850 - () https://medium.com/%40tusharvaidya16/authenticated-blind-error-based-sql-injection-on-local-services-search-engine-management-system-3e99779f0850 -

24 Aug 2021, 17:43

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : 4.0
v3 : 4.9
CWE CWE-89
CPE cpe:2.3:a:local_services_search_engine_management_system_project:local_services_search_engine_management_system:1.0:*:*:*:*:*:*:*
References (MISC) https://medium.com/@tusharvaidya16/authenticated-blind-error-based-sql-injection-on-local-services-search-engine-management-system-3e99779f0850 - (MISC) https://medium.com/@tusharvaidya16/authenticated-blind-error-based-sql-injection-on-local-services-search-engine-management-system-3e99779f0850 - Exploit, Third Party Advisory

19 Aug 2021, 14:39

Type Values Removed Values Added
New CVE
Information

Published : 2021-08-19 14:39

Updated : 2024-11-21 05:58

NVD link : CVE-2021-27999

Mitre link : CVE-2021-27999

CVE.ORG link : CVE-2021-27999

JSON object : View

Products Affected

local_services_search_engine_management_system_project

  • local_services_search_engine_management_system
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')