GitHub Advisoryadvisory · Packagist

GHSA-wf5p-f5xr-c4jj SQL Injection in rosariosis

CRITICAL Published 2021-12-02 Modified 2021-12-01 Official page ↗
Aliases
CVE-2021-44427
Ecosystem
Packagist
Packages
francoisjacquet/rosariosis
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2021-12-01

Affected packages

• Packagist francoisjacquet/rosariosis: < 8.1.1 → fixed in 8.1.1

Description

An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.

Related

Alias · CVE (1)

  • CVE-2021-44427 An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References