{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2021-41649/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2021-41649/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2021-41649/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2021-41649/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2021-41649/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2021-41649"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2021-41649"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2021/CVE-2021-41649.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2021-41649\n\ninfo:\n  name: PuneethReddyHC Online Shopping System homeaction.php SQL Injection\n  author: daffainfo\n  severity: critical\n  description: An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.\n  remediation: |\n    Upgrade to the latest version to mitigate this vulnerability.\n  reference:\n    - https://github.com/MobiusBinary/CVE-2021-41649\n    - https://awesomeopensource.com/project/PuneethReddyHC/online-shopping-system\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-41649\n    - https://github.com/ARPSyndicate/cvemon\n    - https://github.com/Offensive-Penetration-Security/OPSEC-Hall-of-fame\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-41649\n    cwe-id: CWE-89\n    epss-score: 0.5177\n    epss-percentile: 0.98911\n    cpe: cpe:2.3:a:online-shopping-system-advanced_project:online-shopping-system-advanced:-:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: online-shopping-system-advanced_project\n    product: online-shopping-system-advanced\n  tags: cve2021,cve,sqli,injection,online-shopping-system-advanced_project,vkev,vuln\n\nhttp:\n  - method: POST\n    path:\n      - \"{{BaseURL}}/homeaction.php\"\n\n    body: \"cat_id=4'&get_seleted_Category=1\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"text/html\"\n\n      - type: word\n        part: body\n        words:\n          - \"Warning: mysqli_num_rows() expects parameter 1 to be\"\n          - \"xdebug-error xe-warning\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100a949fa2bf72fc1f8f374a69fd32666f215138c191c721dddc363b6b5ca90c69e022100bf71698c6d93b47d6685a9f41e3b995c37a6423ea9b4782fa925bae03a689130:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2021-41649"
}