Critical severity · published Jan 21, 2022
CVE-2021-40247
SQL injection vulnerability in Sourcecodester Budget and Expense Tracker System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username field
9.8
CVSS
2.6%
EPSS
No
On KEV
Description
SQL injection vulnerability in Sourcecodester Budget and Expense Tracker System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username field.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Budget And Expense Tracker System · Oretnom23
1.0 · source: NVD
Affected product
BA
Budget And Expense Tracker System
Oretnom23
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40247
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40247
Exploit
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/B%26E%20Tracker-by:oretnom23-v1.0
Third Party Advisory
https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
More from Budget And Expense Tracker System
8.8
CVE-2023-2772
A vulnerability, which was classified as critical, was found in SourceCodester Budget and Expense Tracker System 1.0
8.8
CVE-2021-41645
Remote Code Execution (RCE) vulnerability exists in Sourcecodester Budget and Expense Tracker System 1.0 that allows a remote malicious user to inject arbitrary code via the image…
7.2
CVE-2024-22628
Budget and Expense Tracker System v1.0 is vulnerable to SQL Injection via /expense_budget/admin/?page=reports/budget&date_start=2023-12-28&date_end=