CVE-2021-36621

Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could authenticate as Administrator.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

2.07% chance of exploitation in the next 30 days, 80th percentile

Published

2021-07-29

Updated

2024-08-04

Proof-of-concept exploits (3)

• http://packetstormsecurity.com/files/164324/Covid-Vaccination-Scheduler-System-1.0-SQL-In…
• nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-18-09-2821
• https://www.exploit-db.com/exploits/50109

References

• CVE Record
• NVD entry

Related

• CVE-2021-36614
• CVE-2021-36622
• CVE-2021-36613
• CVE-2021-36623
• CVE-2021-36609
• CVE-2021-36624