CVE-2021-41609

SQL injection in the ID parameter of the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenticated attacker to retrieve data from the application's backend database via boolean-based blind and UNION injection.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2022-01-28

Last modified

2024-08-04

Weaknesses

CWE-89

Affected products

• Selectsurvey.net (Classapps)

References

• https://www.classapps.com/product_ssv5.aspx
• https://www.optiv.com/insights/source-zero/blog/classapps-inc-selectsurveynet-v50-vulnerabilities-disclosure