CVE-2021-37808

SQL Injection vulnerabilities exist in https://phpgurukul.com News Portal Project 3.1 via the (1) category, (2) subcategory, (3) sucatdescription, and (4) username parameters, the server response is about (N) seconds delay respectively which mean it is vulnerable to MySQL Blind (Time Based). An attacker can use sqlmap to further the exploitation for extracting sensitive information from the database.

CVSS v3.1

5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

1.84% chance of exploitation in the next 30 days, 77th percentile

Published

2021-10-27

Updated

2024-08-04

Proof-of-concept exploits (1)

• nu11secur1ty/CVE-mitre/tree/main/CVE-2021-37808

References

• CVE Record
• NVD entry

Related

• CVE-2021-37807
• CVE-2021-37823
• CVE-2021-37806
• CVE-2021-37832
• CVE-2021-37805
• CVE-2021-37833