CVE-2021-44599 - The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks

Back Back to CVE browser

HIGH

The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks

Published Dec 23, 2021

7.5

HIGH

CVSS 3.1

EPSS 1.21%

Description

The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks. A crafted payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed. The attacker can retrieve sensitive information for all users of this system.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-31421
Advisory
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/Online-Enrollment-Management-System
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-31421		Advisory
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/Online-Enrollment-Management-System		x_refsource_MISCExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Dec 23, 2021

Updated Aug 4, 2024

Reserved Dec 6, 2021

Link CVE-2021-44599

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2021-44599

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Dec 23, 2021

Updated Aug 4, 2024

Link EUVD-2021-31421

GitHub

No data