CVE-2021-36722CWE-89

Emuse - eServices / eNvoice SQL injection

High · published December 29, 2021

CVSS v3.1
7.1
EPSS
1%
Percentile
72.1
In the wild
Unconfirmed
What it is

Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on the affected endpoints. The SQLi caused by CWE-209: Generation of Error Message Containig Sensetive Information, showing parts of the aspx code and the webroot location , information an attacker can leverage to further compromise the host.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01393 · 72.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2021-12-29T14:13Z
EPSS history
Timeline
  • 29 DEC 14:13Z
    Emuse - eServices / eNvoice SQL injection
    cvelistv5