by Kastro
Paper/Archive/CVE-2021-22856

CVE-2021-22856

ChanGate EnterPrise Co., Ltd property management system — ChanGate EnterPrise Co., Ltd property management system - SQL Injection

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 73.8.738 × 2014.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege.

Affected

ProductAffectedFixed inSource
property management system≤ 1.00–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftwcert.org.tw/tw/cp-132-4394-76d41-1.htmlrefchtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422