Critical severity · published Nov 29, 2021
CVE-2021-44427
An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g.,…
9.8
CVSS
50.6%
EPSS
No
On KEV
Description
An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)50.6% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RO
Rosariosis · Rosariosis
before 8.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-44427
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-44427
Exploit
https://gitlab.com/francoisjacquet/rosariosis/-/issues/328
More from Rosariosis
9.8
CVE-2022-2714
Improper Handling of Length Parameter Inconsistency in francoisjacquet/rosariosis
9.8
CVE-2021-44567
An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php
9.1
CVE-2022-2067
SQL Injection in francoisjacquet/rosariosis
7.5
CVE-2023-2665
Storage of Sensitive Data in a Mechanism without Access Control in francoisjacquet/rosariosis
7.5
CVE-2023-0994
Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis