CVE-2021-42667

Katalog CVE

CVSS 9.8 · Critical EPSS 16,0%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada online event booking and reservation system project online event booking and reservation system. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views. An attacker can leverage this vulnerability in order to manipulate the sql query performed. As a result he can extract sensitive data from the web server and in some cases he can use this vulnerability in order to get a remote code execution on the remote web server.

Rincian

Terbit di NVD

5 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

16,0% peluang dieksploitasi; lebih tinggi dari 96,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/TheHackingRabbi/CVE-2021-42667 exploit · advisory pihak ketiga
• https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-42667 exploit · advisory pihak ketiga
• https://www.sourcecodester.com/php/14241/online-event-booking-and-reservation-system-phpmysql.html product · advisory pihak ketiga