CVE-2021-44427 SQL Injection in rosariosis

What is CVE-2021-44427?

CVE-2021-44427 is a critical SQL injection vulnerability in n/a, published on 29 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.

Weakness: CWE-89

Which versions are affected by CVE-2021-44427?

2 open source packages ship an affected version, including francoisjacquet/rosariosis. It affects 1 product.

Products include Rosariosis Rosariosis.

How do I fix CVE-2021-44427?

Upgrade francoisjacquet/rosariosis to 8.1.1 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2021-44427 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-44427 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in n/a

• CVE-2021-44567 SQL injection in francoisjacquet/rosariosis Critical 9.8
• CVE-2022-2036 Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis Critical 9.0
• CVE-2022-2067 SQL Injection in francoisjacquet/rosariosis High 8.8
• CVE-2022-1997 Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis High 8.8
• CVE-2023-0994 Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wf5p-f5xr-c4jj.