CVE-2021-27319

published 2021-03-24

CVE-2021-27319: Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via email parameter.

Priority P2 66 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via email parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
doctor_appointment_system_project	doctor_appointment_system	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /contactus.php↗

command firstname={{randstr}}&lastname={{randstr}}&email={{randstr}}%40test.com'+AND+(SELECT+6133+FROM+(SELECT(SLEEP(6)))nOqb)+AND+'RiUU'='RiUU&comment={{randstr}}&submit=Send+Us↗

sigma↗

id: CVE-2021-27319
http:
- raw:
  - POST /contactus.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    body contains: SLEEP(6) in email parameter
matchers:
- duration>=6
- status_code == 500
- contains(body, "Medical Management System")

• → Detect blind time-based SQLi attempts against /contactus.php: look for POST requests where the email parameter contains SQL sleep payloads (e.g., SLEEP(6)) and the server responds with HTTP 500 after a delay of ≥6 seconds. ↗
• → The response body of the vulnerable Doctor Appointment System contains the string 'Medical Management System'; use this as a fingerprint when hunting for exposed instances. ↗
• → The attack is unauthenticated and targets the email POST parameter in contactus.php; monitor for SQL metacharacters (single quotes, AND/SELECT/SLEEP keywords) in that specific field. ↗

• · The Nuclei template uses a 10-second HTTP timeout (@timeout: 10s) and a SLEEP(6) payload; detection rules based on response-time thresholds should account for network latency to avoid false negatives. ↗
• · Exploitation is confirmed only against Doctor Appointment System version 1.0 (CPE cpe:2.3:a:doctor_appointment_system_project:doctor_appointment_system:1.0); detections should be scoped to this specific version. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89