CVE-2021-32953 MDT AutoSave SQL Injection
SQL injection allows attackers to create users and modify permissions, leading to unauthorized access and privilege escalation in MDT AutoSave.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32953?
CVE-2021-32953 is a critical SQL injection vulnerability in MDT Software A4SP, published on 1 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’s permissions, granting the attacker the ability to login.
Weakness: CWE-89
Which versions are affected by CVE-2021-32953?
It affects 2 products.
Products include Auvesy-Mdt Autosave, Auvesy-Mdt Autosave for System Platform.
How do I fix CVE-2021-32953?
No fix has been published for CVE-2021-32953 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2021-32953 being exploited?
There is no known exploitation of CVE-2021-32953 in the wild and no public exploit code.
Other vulnerabilities in MDT Software A4SP
- CVE-2021-32933 MDT AutoSave Command Injection
- CVE-2021-32937 MDT AutoSave Generation of Error Message Containing Sensitive Information
- CVE-2021-32945 MDT AutoSave Inadequate Encryption Strength
- CVE-2021-32949 MDT AutoSave Relative Path Traversal
- CVE-2021-32957 MDT AutoSave Uncontrolled Search Path Element
Sources
Also known as GHSA-7f6x-229m-7w2q.