CVE-2021-44427: SQL Injection
Published Nov 29, 2021
·Updated
An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
Affected Software
1 affected component
RosarioSIS RosarioSIS<8.1.1
Event History
Nov 29, 2021
CVE Published
via MITRE·09:34 PM
Data Sourced
via MITRE·09:34 PM
DescriptionSeverity
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2021-44427.
2
What is the severity of CVE-2021-44427?
The severity of CVE-2021-44427 is critical with a CVSS score of 9.8.
3
Which software is affected by CVE-2021-44427?
Rosario Student Information System (rosariosis) versions up to 8.1.1 are affected by CVE-2021-44427.
4
How does CVE-2021-44427 impact the affected software?
CVE-2021-44427 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
5
Is authentication required to exploit CVE-2021-44427?
No, this vulnerability can be exploited without authentication.