The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks. A crafted payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed. The attacker can retrieve sensitive information for all users of this system.
References
| Link | Resource |
|---|---|
| https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/Online-Enrollment-Management-System | Exploit Third Party Advisory |
| https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/Online-Enrollment-Management-System | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:31
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/Online-Enrollment-Management-System - Exploit, Third Party Advisory |
04 Jan 2022, 19:32
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/Online-Enrollment-Management-System - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:online_enrollment_management_system_project:online_enrollment_management_system:1.0:*:*:*:*:*:*:* | |
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
23 Dec 2021, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-12-23 13:15
Updated : 2024-11-21 06:31
NVD link : CVE-2021-44599
Mitre link : CVE-2021-44599
CVE.ORG link : CVE-2021-44599
JSON object : View
Products Affected
online_enrollment_management_system_project
- online_enrollment_management_system
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')