What is CVE-2021-23837?

CVE-2021-23837 is a medium-severity vulnerability in Flatcore, classified under SQL Injection. CVSS score: 6.5/10. Published 2021-01-15.

How severe is CVE-2021-23837?

Medium severity. CVSS v3 base score is 6.5 out of 10.

SQL Injection in Flatcore

CVE-2021-23837

An issue was discovered in flatCore before 2.0.0 build 139. A time-based blind SQL injection was identified in the selected_folder HTTP request body parameter for the acp interface. The affected parameter (which retrieves the file contents of the specified folder) was found to be accepting malicious user input without proper sanitization, thus leading to SQL injection. Database related information can be successfully retrieved.

Vulnerability class: SQL Injection

EPSS: 0.015 (70.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Flatcore
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (Product, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-23837?: CVE-2021-23837 is a medium-severity vulnerability in Flatcore, classified under SQL Injection. CVSS score: 6.5/10. Published 2021-01-15.
How severe is CVE-2021-23837?: Medium severity. CVSS v3 base score is 6.5 out of 10.