High severity8.8NVD Advisory· Published Jan 11, 2022· Updated Jun 17, 2026

CVE-2021-43971

Description

A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands via the filterText parameter.

Affected products

SysAid/SysAid ITILdescription
Sysaid/Sysaid2 versions
cpe:2.3:a:sysaid:sysaid:20.4.74:b10:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:sysaid:sysaid:20.4.74:b10:*:*:*:*:*:*
- (no CPE)range: 20.4.74 b10

Patches

Vulnerability mechanics

References

github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0001.mdnvdExploitThird Party Advisory
github.com/atredispartners/advisories/blob/master/ATREDIS-2021-0002.mdnvdBroken Link
www.sysaid.com/it-service-management-software/incident-managementnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000