CVE-2021-36560

Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads to account takeover of the admin.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://pratikkhalane91.medium.com/cve-2021-35559-bb62022dd08a	Exploit Third Party Advisory
https://www.sourcecodester.com/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:phone_shop_sales_management_system_project:phone_shop_sales_management_system:1.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-11-02 10:15

Updated : 2024-02-28 18:48

NVD link : CVE-2021-36560

Mitre link : CVE-2021-36560

CVE.ORG link : CVE-2021-36560

JSON object : View

Products Affected

phone_shop_sales_management_system_project

phone_shop_sales_management_system

CWE

CWE-425

Direct Request ('Forced Browsing')

{"id": "CVE-2021-36560", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-11-02T10:15:07.810", "references": [{"url": "https://pratikkhalane91.medium.com/cve-2021-35559-bb62022dd08a", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.sourcecodester.com/", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-425"}]}], "descriptions": [{"lang": "en", "value": "Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads to account takeover of the admin."}, {"lang": "es", "value": "Phone Shop Sales Managements System usando PHP con C\u00f3digo Fuente versi\u00f3n 1.0, es vulnerable a una omisi\u00f3n de autenticaci\u00f3n, lo que conlleva a una toma de posesi\u00f3n de la cuenta del administrador"}], "lastModified": "2022-07-12T17:42:04.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phone_shop_sales_management_system_project:phone_shop_sales_management_system:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D6031EF-69F7-44A7-9933-D2E9089EF5C1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}