CVE-2021-42334 - OpenCVE

The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Huaju	Easytest Online Learning Test Platform

Configuration 1 [-]

cpe:2.3:a:huaju:easytest_online_learning_test_platform:1705:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2021-10-15T12:10:37.398994Z

Updated: 2024-09-16T16:17:44.540Z

Reserved: 2021-10-12T00:00:00

Link: CVE-2021-42334

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-10-15T12:15:07.890

Modified: 2021-10-20T19:30:45.113

Link: CVE-2021-42334

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Easytest", "vendor": "Huachu Digital Technology Co.,Ltd.", "versions": [{"status": "affected", "version": "1705"}]}], "datePublic": "2021-10-15T00:00:00", "descriptions": [{"lang": "en", "value": "The Easytest contains SQL injection vulnerabilities. After obtaining a user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 SQL Injection", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-10-15T12:10:37", "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"}], "solutions": [{"lang": "en", "value": "Update Easytest to version 2100"}], "source": {"advisory": "TVN-202110006", "discovery": "EXTERNAL"}, "title": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "TWCERT/CC", "ASSIGNER": "cve@cert.org.tw", "DATE_PUBLIC": "2021-10-15T11:57:00.000Z", "ID": "CVE-2021-42334", "STATE": "PUBLIC", "TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Easytest", "version": {"version_data": [{"version_affected": "=", "version_value": "1705"}]}}]}, "vendor_name": "Huachu Digital Technology Co.,Ltd."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Easytest contains SQL injection vulnerabilities. After obtaining a user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-89 SQL Injection"}]}]}, "references": {"reference_data": [{"name": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html", "refsource": "MISC", "url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"}]}, "solution": [{"lang": "en", "value": "Update Easytest to version 2100"}], "source": {"advisory": "TVN-202110006", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:30:38.253Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"}]}]}, "cveMetadata": {"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "assignerShortName": "twcert", "cveId": "CVE-2021-42334", "datePublished": "2021-10-15T12:10:37.398994Z", "dateReserved": "2021-10-12T00:00:00", "dateUpdated": "2024-09-16T16:17:44.540Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:huaju:easytest_online_learning_test_platform:1705:*:*:*:*:*:*:*", "matchCriteriaId": "63605331-63BE-4B6B-9E62-43179A48FAAB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Easytest contains SQL injection vulnerabilities. After obtaining a user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions."}, {"lang": "es", "value": "Easytest contiene vulnerabilidades de inyecci\u00f3n SQL. Despu\u00e9s de alcanzar privilegios de usuario, unos atacantes remotos pueden inyectar comandos SQL en los par\u00e1metros de la p\u00e1gina de administraci\u00f3n de cursos electivos para obtener todos los permisos de base de datos y de administrador"}], "id": "CVE-2021-42334", "lastModified": "2021-10-20T19:30:45.113", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "twcert@cert.org.tw", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Secondary"}]}, "published": "2021-10-15T12:15:07.890", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "twcert@cert.org.tw", "type": "Secondary"}]}