CVE-2021-42667 PoC — Engineers Online Portal SQL注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42667.yaml

Associated Vulnerability

Title:Engineers Online Portal SQL注入漏洞 (CVE-2021-42667)
Description:Engineers Online Portal是开源的一个在线门户。是使用PHP、MySQL 数据库、HTML、CSS、Javascript、jQuery、Ajax、Bootstrap 和一些其他库开发的。 Engineers Online Portal 存在SQL注入漏洞，该漏洞源于事件管理视图中，PHP的Sourcecodester在线事件预订和预订系统存在SQL注入漏洞。攻击者可利用该漏洞来操纵所执行的sql查询，因此他可以从web服务器提取敏感数据以便在远程web服务器上执行远程代码。

Description

Online Event Booking and Reservation System 2.3.0 contains a SQL injection vulnerability in event-management/views. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.

File Snapshot


 id: CVE-2021-42667

info:
  name: Online Event Booking and Reservation System 2.3.0 - SQL Injection


...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!