CVE-2021-39402

{"id": "CVE-2021-39402", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2021-09-20T15:15:08.940", "references": [{"url": "https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.maianscriptworld.co.uk/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.maianscriptworld.co.uk/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "MaianAffiliate v.1.0 is suffers from code injection by adding a new product via the admin panel. The injected payload is reflected on the affiliate main page for all authenticated and unauthenticated visitors."}, {"lang": "es", "value": "MaianAffiliate versi\u00f3n v.1.0, sufre una inyecci\u00f3n de c\u00f3digo al a\u00f1adir un nuevo producto por medio del panel de administraci\u00f3n. La carga \u00fatil inyectada es reflejada en la p\u00e1gina principal del afiliado para todos los visitantes autenticados y no autenticados"}], "lastModified": "2024-11-21T06:19:28.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:maianmedia:maianaffiliate:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "894249B4-A2E3-475A-9688-C00DC270EAE7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}