CVE-2021-41746: SQL Injection
Published Oct 29, 2021
·Updated
SQL Injection vulnerability exists in all versions of Yonyou TurboCRM.via the orgcode parameter in changepswd.php. Attackers can use the vulnerabilities to obtain sensitive database information.
Affected Software
1 affected component
Yonyou TurboCRM
Event History
Oct 29, 2021
CVE Published
via MITRE·05:22 PM
Data Sourced
via MITRE·05:22 PM
Description
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this SQL injection vulnerability?
The vulnerability ID is CVE-2021-41746.
2
What software is affected by this SQL injection vulnerability?
All versions of Yonyou TurboCRM are affected.
3
How can attackers exploit this SQL injection vulnerability?
Attackers can exploit this vulnerability by using the orgcode parameter in changepswd.php to obtain sensitive database information.
4
What is the severity of CVE-2021-41746?
The severity of CVE-2021-41746 is high with a severity value of 7.5.
5
Is there a fix available for this SQL injection vulnerability?
Yes, it is recommended to update to a patched version of Yonyou TurboCRM to fix this vulnerability.