CVE-2021-37832

{"id": "CVE-2021-37832", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-08-03T13:15:09.393", "references": [{"url": "https://github.com/dievus/CVE-2021-37832", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.hoteldruid.com", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/dievus/CVE-2021-37832", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.hoteldruid.com", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database. A malicious attacker can issue SQL commands to the SQLite database through the vulnerable idappartamenti parameter."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de inyecci\u00f3n SQL en la versi\u00f3n 3.0.2 de Hotel Druid cuando SQLite es usado como base de datos de la aplicaci\u00f3n. Un atacante malicioso puede emitir comandos SQL a la base de datos SQLite mediante el par\u00e1metro vulnerable idappartamenti"}], "lastModified": "2024-11-21T06:15:56.507", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:digitaldruid:hoteldruid:3.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6051EDA7-2422-4343-849A-2D2B6A81BEEA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}