nvd-json-data-feeds/CVE-2021/CVE-2021-416xx/CVE-2021-41647.json

{
  "id": "CVE-2021-41647",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2021-10-01T15:15:07.947",
  "lastModified": "2021-10-08T15:19:35.987",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0. An attacker can exploit the vulnerable \"username\" parameter in login.php and retrieve sensitive database information, as well as add an administrative user."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de inyecci\u00f3n SQL ciega no autenticada basada en errores y en el tiempo en Kaushik Jadhav Online Food Ordering Web App versi\u00f3n 1.0. Un atacante puede explotar el par\u00e1metro vulnerable \"username\" en el archivo login.php y recuperar informaci\u00f3n confidencial de la base de datos, as\u00ed como a\u00f1adir un usuario administrativo"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.4
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 10.0,
        "impactScore": 4.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:online_food_ordering_web_app_project:online_food_ordering_web_app:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C26E6C6-D598-4ABE-9707-9A94E9096A98"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/164422/Online-Food-Ordering-Web-App-SQL-Injection.html",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/MobiusBinary/CVE-2021-41647",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/kaushikjadhav01/Online-Food-Ordering-Web-App",
      "source": "cve@mitre.org",
      "tags": [
        "Product",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41647",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}