CVE-2021-3239

CriticalPublic PoC

Published: 15 February 2021

Published

15 February 2021

Modified

21 November 2024

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.6268 98.4th percentile

Risk Priority 57 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-3239 is a critical-severity SQL Injection (CWE-89) vulnerability in E-Learning System Project E-Learning System. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2021-26578

Vulnerability details

E-Learning System 1.0 suffers from an unauthenticated SQL injection vulnerability, which allows remote attackers to execute arbitrary code on the hosting web server and gain a reverse shell.

CWE(s): CWE-89

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

e-learning system project

e-learning system

1.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

SI-10 Information Input Validation

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References

https://github.com/TCSWT/E-Learning-System/blob/main/README.md
Exploit, Third Party Advisory · cve@mitre.org
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/CVE-nu11-101821
Exploit, Third Party Advisory · cve@mitre.org
https://packetstormsecurity.com/files/160966/E-Learning-System-1.0-SQL-Injection-Shell-Upload.html
Exploit, Third Party Advisory, VDB Entry · cve@mitre.org
https://www.exploit-db.com/exploits/49434
Exploit, Third Party Advisory, VDB Entry · cve@mitre.org
https://www.sourcecodester.com/php/12808/e-learning-system-using-phpmysqli.html
Product, Third Party Advisory · cve@mitre.org
https://github.com/TCSWT/E-Learning-System/blob/main/README.md
Exploit, Third Party Advisory · af854a3a-2127-422b-91ae-364da2661108
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/CVE-nu11-101821
Exploit, Third Party Advisory · af854a3a-2127-422b-91ae-364da2661108
https://packetstormsecurity.com/files/160966/E-Learning-System-1.0-SQL-Injection-Shell-Upload.html
Exploit, Third Party Advisory, VDB Entry · af854a3a-2127-422b-91ae-364da2661108
https://www.exploit-db.com/exploits/49434
Exploit, Third Party Advisory, VDB Entry · af854a3a-2127-422b-91ae-364da2661108
https://www.sourcecodester.com/php/12808/e-learning-system-using-phpmysqli.html
Product, Third Party Advisory · af854a3a-2127-422b-91ae-364da2661108