VulnerabilityModified
CVE-2021-22856
The CGE property management system contains SQL Injection vulnerabilities.
HIGH 7.5EPSS 1.47%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.47%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.47% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- changjia property management system project/changjia property management system
- Source
- twcert@cert.org.tw
References
- https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422Third Party Advisory
- https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.htmlThird Party Advisory
- https://www.chtsecurity.com/news/fe1e30ef-4dac-4848-a3c9-a7df12672422Third Party Advisory
- https://www.twcert.org.tw/tw/cp-132-4394-76d41-1.htmlThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.