CVE-2021-42334

The Easytest contains SQL injection vulnerabilities. After obtaining a users privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
twcertCNA
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 46%
Common Weakness Enumeration
References
https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html
https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html