{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-41649/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-41649/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-41649/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-41649/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-41649/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-41649"},"sightings":{"href":"/api/v1/sightings/cve-2021-41649"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-41649.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-41649\n\ninfo:\n  name: PuneethReddyHC Online Shopping System homeaction.php SQL Injection\n  author: daffainfo\n  severity: critical\n  description: An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.\n  remediation: |\n    Upgrade to the latest version to mitigate this vulnerability.\n  reference:\n    - https://github.com/MobiusBinary/CVE-2021-41649\n    - https://awesomeopensource.com/project/PuneethReddyHC/online-shopping-system\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-41649\n    - https://github.com/ARPSyndicate/cvemon\n    - https://github.com/Offensive-Penetration-Security/OPSEC-Hall-of-fame\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-41649\n    cwe-id: CWE-89\n    epss-score: 0.5177\n    epss-percentile: 0.98911\n    cpe: cpe:2.3:a:online-shopping-system-advanced_project:online-shopping-system-advanced:-:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: online-shopping-system-advanced_project\n    product: online-shopping-system-advanced\n  tags: cve2021,cve,sqli,injection,online-shopping-system-advanced_project,vkev,vuln\n\nhttp:\n  - method: POST\n    path:\n      - \"{{BaseURL}}/homeaction.php\"\n\n    body: \"cat_id=4'&get_seleted_Category=1\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"text/html\"\n\n      - type: word\n        part: body\n        words:\n          - \"Warning: mysqli_num_rows() expects parameter 1 to be\"\n          - \"xdebug-error xe-warning\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100a949fa2bf72fc1f8f374a69fd32666f215138c191c721dddc363b6b5ca90c69e022100bf71698c6d93b47d6685a9f41e3b995c37a6423ea9b4782fa925bae03a689130:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2021-41649"}