Vulnerability · Published Dec 29, 2021 · Assigned by INCD

CVE-2021-36722Emuse - eServices / eNvoice SQL injection

High 7.1

In plain English

A high-severity SQL injection in eServices / eNvoice from Emuse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)1.4%top 27.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on the affected endpoints. The SQLi caused by CWE-209: Generation of Error Message Containig Sensetive Information, showing parts of the aspx code and the webroot location , information an attacker can leverage to further compromise the host.

Affected products (as reported)

Vendor	Product	Versions
Emuse	eServices / eNvoice	Production

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

https://www.gov.il/en/departments/faq/cve_advisories x_refsource_CONFIRM