cve/2021/CVE-2021-37538.md

CVE-2021-37538

Description

Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controllers/front/archive.php archive controller, or the id_category parameter to the controllers/front/category.php category controller.

POC

Reference

• https://blog.sorcery.ie/posts/smartblog_sqli/

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/StarCrossPortal/scalpel
• https://github.com/anonymous364872/Rapier_Tool
• https://github.com/apif-review/APIF_tool_2024
• https://github.com/youcans896768/APIV_Tool