CVE-2021-47811

HighPublic PoC

Published: 16 January 2026

Published

16 January 2026

Modified

02 February 2026

KEV Added

—

Patch

—

CVSS Score v4 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0053 40.7th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2021-47811 is a high-severity SQL Injection (CWE-89) vulnerability in Grocerycrud Grocery Crud. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2021-47811 is a SQL injection vulnerability (CWE-89) affecting Grocery Crud version 1.6.4. The flaw resides in the order_by parameter, specifically the order_by[] array in POST requests to the ajax_list endpoint, which allows remote attackers to inject malicious SQL code and manipulate database queries. The vulnerability has a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to high impacts on confidentiality and integrity.

Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. By sending crafted POST requests with malicious payloads in the order_by[] parameter, attackers can execute arbitrary SQL queries, potentially extracting sensitive database information or modifying data.

Advisories and references, including those from Vulncheck and Exploit-DB (exploit 49985), detail the vulnerability and provide proof-of-concept exploits. The official Grocery Crud website and downloads page offer resources for the affected software, though specific patch details are not outlined in the CVE description. Security practitioners should review these sources for mitigation guidance and upgrade recommendations.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-3020

Vulnerability details

Grocery Crud 1.6.4 contains a SQL injection vulnerability in the order_by parameter that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the order_by[] parameter in POST requests to the ajax_list endpoint to potentially extract…

or modify database information.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Direct remote SQL injection in public-facing web application (ajax_list endpoint) enables unauthenticated exploitation for initial access and data manipulation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0