CVE-2021-41647

Katalog CVE

CVSS 9.1 · Critical EPSS 2,0%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada online food ordering web app project online food ordering web app. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0. An attacker can exploit the vulnerable "username" parameter in login.php and retrieve sensitive database information, as well as add an administrative user.

Rincian

Terbit di NVD

1 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 80,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/164422/Online-Food-Ordering-Web-App-SQL-Injection.html exploit · advisory pihak ketiga
• https://github.com/MobiusBinary/CVE-2021-41647 exploit · advisory pihak ketiga
• https://github.com/kaushikjadhav01/Online-Food-Ordering-Web-App product · advisory pihak ketiga
• https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41647 exploit · advisory pihak ketiga