Security Advisory

CVE-2021-44599

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2021-12-23 12:31:27

Last updated 2024-08-04 04:25:16

Assigner mitre

State PUBLISHED

Description

The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks. A crafted payload injects a SQL sub-query that calls MySQLs load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed. The attacker can retrieve sensitive information for all users of this system.

← Browse all CVEs View on cve.org ↗