CVE-2021-27316

published 2021-03-24

CVE-2021-27316: Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via lastname parameter.

Priority P2 66 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via lastname parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
doctor_appointment_system_project	doctor_appointment_system	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /contactus.php↗

command firstname={{randstr}}&lastname=test'+AND+(SELECT+6133+FROM+(SELECT(SLEEP(6)))nOqb)+AND+'RiUU'='RiUU&email={{randstr}}%40test.com&comment={{randstr}}&submit=Send+Us↗

url POST /contactus.php HTTP/1.1↗

• → Detect time-based blind SQLi exploitation attempts against contactus.php by monitoring for POST requests containing SLEEP() payloads in the 'lastname' parameter. ↗
• → A successful exploitation attempt results in an HTTP 500 response and the response body contains the string 'Medical Management System'; correlate with response time >= 6 seconds for time-based blind SQLi confirmation. ↗
• → The attack is unauthenticated and targets the POST body parameter 'lastname' in contactus.php; no session or authentication token is required, making it detectable at the perimeter/WAF layer. ↗
• → Content-Type of the malicious POST request is 'application/x-www-form-urlencoded'; inspect POST bodies of this type to contactus.php for SQL metacharacters and SLEEP/SELECT subquery patterns. ↗

• · The Nuclei template uses a 10-second HTTP timeout (@timeout: 10s) and a SLEEP(6) payload; detection rules based on response-time thresholds should account for network latency to avoid false negatives. ↗
• · All three matcher conditions must be satisfied simultaneously (duration>=6, status_code==500, body contains 'Medical Management System') to confirm exploitation; partial matches may indicate probing or false positives. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89