VulnerabilityModified
CVE-2021-42665
An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication.
CRITICAL 9.8EPSS 4.95%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.95%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 4.95% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- engineers online portal project/engineers online portal
- Source
- cve@mitre.org
References
- https://github.com/TheHackingRabbi/CVE-2021-42665Exploit, Third Party Advisory
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-42665Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/50452Exploit, Third Party Advisory, VDB Entry
- https://www.sourcecodester.com/php/13115/engineers-online-portal-php.htmlProduct, Third Party Advisory
- https://github.com/TheHackingRabbi/CVE-2021-42665Exploit, Third Party Advisory
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-42665Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/50452Exploit, Third Party Advisory, VDB Entry
- https://www.sourcecodester.com/php/13115/engineers-online-portal-php.htmlProduct, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.