CVE-2021-45411

In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi, an attacker can log in and leverage an arbitrary file upload vulnerability to obtain remote code execution.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

3.86% chance of exploitation in the next 30 days, 90th percentile

Published

2022-01-12

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/49877

Security advisories

• https://www.sourcecodester.com/php/12802/php-staff-id-card-creation-and-printing-system.h…

References

• CVE Record
• NVD entry