by Kastro
Paper/Archive/CVE-2021-41647

CVE-2021-41647

mitre — An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0.

EPSS 2%CVSS 9.1
critical.is priorityof 100
44
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 80.8.808 × 2016.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0. An attacker can exploit the vulnerable "username" parameter in login.php and retrieve sensitive database information, as well as add an administrative user.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refgithub.com/kaushikjadhav01/Online-Food-Ordering-Web-Apprefgithub.com/MobiusBinary/CVE-2021-41647refpacketstormsecurity.com/files/164422/Online-Food-Ordering-Web-App-SQL-Injection.htmlrefgithub.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41647