cbcvebase.
CVE-2021-41648
published 2021-10-01

CVE-2021-41648: An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter. Using a post request does…

PriorityP261high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
10.01%
95.0th percentile
An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter. Using a post request does not sanitize the user input.

Detection & IOCsextracted from sources · hover to see the quote

path/action.php↗
commandproId=1'&addToCart=1↗
urlhttp://packetstormsecurity.com/files/165036/PuneethReddyHC-Online-Shopping-System-Advanced-1.0-SQL-Injection.html↗
  • →Detect exploitation attempts by matching POST requests to /action.php containing a single-quote in the proId parameter (e.g., proId=1') combined with addToCart=1 in the body. ↗
  • →Successful exploitation produces a PHP warning in the HTTP response body: 'Warning: mysqli_num_rows() expects parameter 1 to be' — use this as an error-based SQLi confirmation signature. ↗
  • →Secondary response body indicator for successful exploitation is the presence of the string 'xdebug-error xe-warning', indicating verbose PHP/xdebug error output triggered by the injected payload. ↗
  • →The attack uses an unauthenticated HTTP POST request — no session cookie or authentication header is required. Monitor for POST requests to /action.php from unauthenticated sessions. ↗
  • ·The Nuclei template requires BOTH body strings ('Warning: mysqli_num_rows() expects parameter 1 to be' AND 'xdebug-error xe-warning') to be present simultaneously (condition: and) for a positive match — a target without xdebug enabled will not trigger the matcher even if vulnerable. ↗
  • ·The template also requires an HTTP 200 status code response; exploitation attempts that result in other status codes (e.g., 500) will not be flagged by this detection logic. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.