CVE-2021-47956

Vulnerability

Overview

CVE-2021-47956 is an SQL injection vulnerability in EgavilanMedia PHPCRUD version 1.0. The application fails to properly sanitize user input passed to the firstname parameter in the insert.php endpoint. An attacker can inject arbitrary SQL commands by sending a crafted POST request, as the parameter is directly concatenated into database queries without proper neutralization [1][2].

Exploitation

The vulnerability is exploitable without authentication. An attacker only needs to send a POST request to insert.php with a malicious firstname value. The exploit can be performed using tools like Burp Suite to capture the request and modify the request, or with automated tools like sqlmap to automate the injection and data extraction. The attack vector is network-based, requiring no special privileges or user interaction [1].

Impact

Successful exploitation allows an unauthenticated attacker to extract sensitive information from the underlying database, including user credentials, personal data, or other confidential records. The CVSS v3.1 base score is 8.2 (High), with the vector indicating high confidentiality impact, low integrity impact, and no availability impact [2].

Mitigation

As of the advisory publication, no patch has been released for PHPCRUD 1.0. Users are advised to apply input validation and parameterized queries to mitigate the risk, or consider migrating to an alternative solution if the software is no longer maintained [1][2].