Critical severity · published Nov 15, 2021
CVE-2021-41765
A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL…
9.8
CVSS
67.8%
EPSS
No
On KEV
Description
A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. This allows attackers to uncover the full contents of the ResourceSpace database, including user session cookies. An attacker who gets an admin user session cookie can use the session cookie to execute arbitrary code on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)67.8% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Resourcespace · Montala
9.5; 9.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41765
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41765
Broken Link
http://svn.resourcespace.com/svn/rs/releases/9.6/pages/edit_fields/9_ajax/add_keyword.php
Exploit
https://www.horizon3.ai/multiple-vulnerabilities-in-resourcespace/
More from Resourcespace
9.1
CVE-2021-41950
A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the…
7.5
CVE-2019-25662
ResourceSpace 8.6 SQL Injection via watched_searches.php
7.1
CVE-2019-25693
ResourceSpace 8.6 SQL Injection via collection_edit.php
6.5
CVE-2022-31260
In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collection metadata via a non-NULL k value
6.1
CVE-2021-41951
ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter