CVEvulnerability
CVE-2021-43609
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-11-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-89
Description
An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within the order_by_for_ticket function in app/models/reporting/database_query.rb allows an authenticated attacker to execute arbitrary SQL commands via the sort parameter. This can be leveraged to leak local files from the host system, leading to remote code execution (RCE) through deserialization of malicious data.
Affected configurations
• spiceworks help desk server (< 1.3.3)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://community.spiceworks.com/blogs/help-desk-server-release-notes/3610-1-3-2-1-3-3 Release Notes
- https://github.com/d5sec/CVE-2021-43609-POC Third Party Advisory
- https://www.linkedin.com/pulse/cve-2021-43609-write-up-division5-security-4lgwe Exploit, Third Party Advisory
- https://community.spiceworks.com/blogs/help-desk-server-release-notes/3610-1-3-2-1-3-3 Release Notes
- https://github.com/d5sec/CVE-2021-43609-POC Third Party Advisory
- https://www.linkedin.com/pulse/cve-2021-43609-write-up-division5-security-4lgwe Exploit, Third Party Advisory