CVE-2021-47918
Published: 01 February 2026
Summary
CVE-2021-47918 is a high-severity SQL Injection (CWE-89) vulnerability in Simplephpscripts Simple Cms Php. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-47918 is a remote SQL injection vulnerability (CWE-89) affecting Simple CMS version 2.1. The issue arises in the users module, where unvalidated input parameters in the admin.php file allow attackers to inject unfiltered SQL commands. This flaw enables compromise of the underlying database management system and the web application itself.
The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating it can be exploited remotely with low attack complexity by users possessing low privileges, without requiring user interaction and without impacting scope. Successful exploitation allows attackers to achieve high confidentiality and integrity impacts, such as extracting sensitive data from the database or modifying application data.
Advisories providing further details, including potential mitigation steps, are available at https://simplephpscripts.com/simple-cms-php, https://www.vulncheck.com/advisories/simple-cms-sql-injection-vulnerability-via-users-module2, and https://www.vulnerability-lab.com/get_content.php?id=2303. Security practitioners should review these resources for vendor-recommended patches or workarounds.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-34753
Vulnerability details
Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web…
more
application.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote SQL injection in a public-facing web application (admin.php) enables initial access via exploitation of a web app vulnerability.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the unvalidated input parameters in admin.php that enable SQL injection by requiring validation of all information inputs to prevent malicious SQL commands.
Ensures timely identification, reporting, and correction of the specific SQL injection flaw in Simple CMS 2.1, preventing exploitation.
Enables vulnerability scanning to identify the SQL injection vulnerability in the users module, facilitating remediation before exploitation.