Vulnerability · Published Jan 8, 2023 · Assigned by VulDB

CVE-2021-4308WebPA sql injection

Medium 5.5

In plain English

A medium-severity SQL injection in WebPA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.7%top 46.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in WebPA up to 3.1.1. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. Upgrading to version 3.1.2 is able to address this issue. The identifier of the patch is 8836c4f549181e885a68e0e7ca561fdbcbd04bf0. It is recommended to upgrade the affected component. The identifier VDB-217637 was assigned to this vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	webpa/webpa	3.1.2	GHSA-mjgw-f2c4-f8qj

Affected products (as reported)

Vendor	Product	Versions
n/a	WebPA	3.1.03.1.1

Weakness: CWE-89 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.217637 vdb-entry, technical-description
https://vuldb.com/?ctiid.217637 signature, permissions-required
https://github.com/WebPA/WebPA/pull/87 issue-tracking
https://github.com/WebPA/WebPA/commit/8836c4f549181e885a68e0e7ca561fdbcbd04bf0 patch
https://github.com/WebPA/WebPA/releases/tag/v3.1.2 patch