CVE-2021-21915: SQL Injection

Published Dec 22, 2021

Updated

An exploitable SQL injection vulnerability exist in the ‘grouplist’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted HTTP request at ‘companyfilter’ parameter. An attacker can make authenticated HTTP requests to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery.

Affected Software

1 affected component

Advantech R-SeeNet=2.4.15

Event History

Dec 22, 2021

CVE Published

via MITRE·06:06 PM

Data Sourced

via MITRE·06:06 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this SQL injection vulnerability?

The vulnerability ID for this SQL injection vulnerability is CVE-2021-21915.

What software is affected by this vulnerability?

The Advantech R-SeeNet version 2.4.15 is affected by this vulnerability.

What is the severity of CVE-2021-21915?

CVE-2021-21915 has a severity value of 8.8, which is considered high.

How can an attacker exploit this vulnerability?

An attacker with authenticated access can exploit this vulnerability by sending a specially-crafted HTTP request to the 'group_list' page with a malicious parameter value.

Is there a patch or fix available for this vulnerability?

It is recommended to update to a fixed version of Advantech R-SeeNet to address this SQL injection vulnerability.