Vulnerability · Published Feb 17, 2021 · Assigned by twcert
CVE-2021-22854Soar Cloud System Co., Ltd. HR Portal - SQL Injection
High 7.5
In plain English
A high-severity SQL injection in HR Portal from Soar Cloud System Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.6%top 24.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The HR Portal of Soar Cloud System fails to filter specific parameters. Remote attackers can inject SQL syntax and obtain all data in the database without privilege.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Soar Cloud System Co., Ltd. | HR Portal | 0 7.3.2020.1013 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://www.twcert.org.tw/tw/cp-132-4404-3f498-1.html x_refsource_MISC
- https://www.chtsecurity.com/news/d334641f-2b28-4eab-a5ed-c6ec6740557e x_refsource_CONFIRM