CVE-2021-37808: SQL Injection
First published: Wed Oct 27 2021(Updated: )
SQL Injection vulnerabilities exist in https://phpgurukul.com News Portal Project 3.1 via the (1) category, (2) subcategory, (3) sucatdescription, and (4) username parameters, the server response is about (N) seconds delay respectively which mean it is vulnerable to MySQL Blind (Time Based). An attacker can use sqlmap to further the exploitation for extracting sensitive information from the database.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| News Portal Project News Portal | =3.1 | |
| Phpgurukul News Portal | =3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- collector/nvd-api
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/tags
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- vendor/news portal project
- canonical/news portal project news portal
- version/news portal project news portal/3.1
- vendor/phpgurukul
- canonical/phpgurukul news portal
- version/phpgurukul news portal/3.1