GobyVuls/CVE-2021-42392.md

H2 Database Console login.do Code Execution Vulnerability (CVE-2021-42392)

Vulnerability	H2 Database Console login.do Code Execution Vulnerability (CVE-2021-42392)
Chinese name	H2 Database 数据库 login.do 文件远程代码执行漏洞 (CVE-2021-42392)
CVSS core	9.0
FOFA Query (click to view the results directly)	body="login.jsp?jsessionid=" && body="Welcome to H2"
Number of assets affected	488
Description	H2 database is a Java memory database, which is mainly used for unit testing. There is an unauthorized remote code execution vulnerability in the H2 Database Web management page. An attacker can use this vulnerability to arbitrarily execute code on the server side, write to the back door, and obtain server permissions, thereby controlling the entire web server.
Impact	Attackers can use this vulnerability to arbitrarily execute code on the server side, write backdoors, obtain server permissions, and then control the entire web server.