The Company's Recruitment Management System in id=2 of the parameter from view_vacancy app on-page appears to be vulnerable to SQL injection. The payloads 19424269' or '1309'='1309 and 39476597' or '2917'='2923 were each submitted in the id parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
References
| Link | Resource |
|---|---|
| https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-20-100121 | Exploit Third Party Advisory |
| https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-20-100121 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-20-100121 - Exploit, Third Party Advisory |
18 Nov 2021, 17:43
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
| CWE | CWE-89 | |
| CPE | cpe:2.3:a:recruitment_management_system_project:recruitment_management_system:-:*:*:*:*:*:*:* | |
| References | (MISC) https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-20-100121 - Exploit, Third Party Advisory |
17 Nov 2021, 13:12
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-11-17 12:15
Updated : 2024-11-21 06:26
NVD link : CVE-2021-41931
Mitre link : CVE-2021-41931
CVE.ORG link : CVE-2021-41931
JSON object : View
Products Affected
recruitment_management_system_project
- recruitment_management_system
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')