SQL Injection in Linux Kernel
CVE-2021-26634
SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboard, which may lead to arbitrary code execution or privilege escalation. Attackers can use these vulnerabilities to perform attacks such as stealing server management rights using a web shell.
Vulnerability class: SQL Injection
EPSS: 0.013 (66.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Linux Linux_kernel
- Maxb Maxboard
- Max Yi Maxboard — versions unspecified
Weakness classification (CWE)
References
- vuln@krcert.or.kr (Third Party Advisory, x_refsource_MISC, Broken Link)
Frequently asked questions
- What is CVE-2021-26634?
- CVE-2021-26634 is a critical-severity vulnerability in Linux Kernel, classified under SQL Injection. CVSS score: 9.8/10. Published 2022-06-02.
- How severe is CVE-2021-26634?
- Critical severity. CVSS v3 base score is 9.8 out of 10.