CVE-2021-47763
Published: 15 January 2026
Summary
CVE-2021-47763 is a high-severity SQL Injection (CWE-89) vulnerability in Aimeos (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-47763 is a SQL injection vulnerability (CWE-89) in Aimeos 2021.10 LTS, an e-commerce package. The issue affects the JSON API 'sort' parameter, where insufficient input validation allows attackers to inject malicious database queries through crafted GET requests to the jsonapi/review endpoint. This results in a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to network accessibility and significant confidentiality impact.
Unauthenticated remote attackers can exploit the vulnerability by manipulating the 'sort' parameter in requests to the jsonapi/review endpoint, enabling them to reveal database table and column names. Successful exploitation allows injection of arbitrary SQL queries, potentially leading to unauthorized data disclosure with high confidentiality impact and low integrity impact, though no availability impact.
Advisories and further details are available on the Aimeos website at https://aimeos.org and https://aimeos.org/laravel-ecommerce-package. A proof-of-concept exploit demonstrating the SQL injection is published at https://www.exploit-db.com/exploits/50538.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2770
Vulnerability details
Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to…
more
the jsonapi/review endpoint.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated SQL injection in public JSON API endpoint enables remote exploitation of the web application for data disclosure.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by requiring validation of the 'sort' parameter to ensure it conforms to expected formats before database query execution.
SI-2 mandates timely remediation of the specific SQL injection flaw in Aimeos 2021.10 LTS through patching or code correction.
SI-9 restricts the 'sort' parameter to whitelisted safe values at the jsonapi/review endpoint, blocking malicious SQL payloads.