CVE-2021-28419

The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve all databases.

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

10.67% chance of exploitation in the next 30 days, 95th percentile

Nuclei

high · CWE-89

Published

2021-03-18

Updated

2024-08-03

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/162322/SEO-Panel-4.8.0-SQL-Injection.html
• seopanel/Seo-Panel/issues/209

Nuclei templates (1)

• linuxadi/40k-nuclei-templates/blob/main/aditya/folder3/CVE-2021-28419.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/49804

References

• CVE Record
• NVD entry

Related

• CVE-2020-35930
• CVE-2021-28417
• CVE-2021-28418
• CVE-2021-28420
• CVE-2021-29008
• CVE-2021-29009