CVE-2021-44427 in the critical feed json
SQL Injection in rosariosis
published 4y ago modified 4mo ago also GHSA-wf5p-f5xr-c4jj , EUVD-2021-2602
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 50.6%
- EPSS 50.6% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
Patch / fix
- packagist francoisjacquet/rosariosis 8.1.1
- rosariosis rosariosis 8.1.1
Is CVE-2021-44427 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
50.64% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Nuclei template Rosario Student Information System Unauthenticated SQL Injection nuclei detection template
- gitlab.com https://gitlab.com/francoisjacquet/rosariosis/-/issues/328 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | francoisjacquet/rosariosis | <8.1.1 |
8.1.1 |
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/francoisjacquet/rosariosis/commit/e001430aa9fb53d2502fb6f036f6c51c578d2016
web
-
gitlab.com
/francoisjacquet/rosariosis/-/commit/e001430aa9fb53d2502fb6f036f6c51c578d2016
web
-
gitlab.com
/francoisjacquet/rosariosis/-/issues/328
web, exploit, issue-tracking, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-44427
advisory
-
github.com
/francoisjacquet/rosariosis
package
-
gitlab.com
/francoisjacquet/rosariosis/blob/mobile/CHANGES.md#changes-in-811
web
Sources
- CVE List CVE-2021-44427
- GitHub Advisory GHSA-wf5p-f5xr-c4jj
- NVD CVE-2021-44427
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.