Vulnerability Details CVE-2021-41920
webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /includes/library.php, via the sor_cible, sor_champs, and sor_ordre HTTP POST parameters. This allows an attacker to access all the data in the database and obtain access to the webTareas application.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.022
EPSS Ranking 83.6%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
Products affected by CVE-2021-41920
-
cpe:2.3:a:webtareas_project:webtareas:2.0
-
cpe:2.3:a:webtareas_project:webtareas:2.1
-
cpe:2.3:a:webtareas_project:webtareas:2.2
-
cpe:2.3:a:webtareas_project:webtareas:2.4