Rosario Student Information System Unauthenticated SQL Injection

criticalseverity

9.8CVSS score

50.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

An unauthenticated SQL injection vulnerability in Rosario Student Information System (aka rosariosis) 8.1 and below allow remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to extract sensitive information from the database, modify data, or execute arbitrary SQL commands.

Fix

Upgrade to version 8.1.1 or higher.

How to confirm it

Send: POST {{BaseURL}}/Side.php
Positive when: contains "DB Execute Failed. ERROR:" and "unterminated quoted string" AND contains in header "RosarioSIS=" AND status 200

Run it with nuclei: nuclei -id CVE-2021-44427 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-44427

info:
  name: Rosario Student Information System Unauthenticated SQL Injection
  author: furkansayim,xShuden
  severity: critical
  description: An unauthenticated SQL injection vulnerability in Rosario Student Information System (aka rosariosis) 8.1 and below allow remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to extract sensitive information from the database, modify data, or execute arbitrary SQL commands.
  remediation: Upgrade to version 8.1.1 or higher.
  reference:
    - https://gitlab.com/francoisjacquet/rosariosis/-/issues/328
    - https://twitter.com/RemotelyAlerts/status/1465697928178122775
    - https://nvd.nist.gov/vuln/detail/CVE-2021-44427
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-44427
    cwe-id: CWE-89
    epss-score: 0.50641
    epss-percentile: 0.98928
    cpe: cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: rosariosis
    product: rosariosis
  tags: cve,cve2021,sqli,rosariosis,vkev,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/Side.php"

    body: "sidefunc=update&syear=111'"

    headers:
      Content-Type: application/x-www-form-urlencoded; charset=utf-8

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "DB Execute Failed. ERROR:"
          - "unterminated quoted string"
        condition: and

      - type: word
        part: header
        words:
          - "RosarioSIS="

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from