CVE-2021-36800 - CVE House
Back to Database
Status published High CVE-2021-36800

Akaunting OS Command Injection in 'Money.php'

Vulnerability Description

Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /{company_id}/sales/invoices/{invoice_id} with an items[0][price] that includes a PHP callable function is executed directly. This issue was fixed in version 2.1.13 of the product.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-36800

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Wiktor Sędkowski of Nokia and Trevor Christiansen of Rapid7 discovered and reported this issue through Rapid7's vulnerability disclosure program.

References

More from Akaunting

View All →
CVE-2024-58293
Akaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields
High 8.6
CVE-2021-36805
Akaunting Invoice Footer Persistent XSS
Medium 5.2
CVE-2021-36804
Akaunting Password Reset Relay
Medium 5.4
CVE-2021-36803
Akaunting Avatar Persistent XSS
Medium 6.3
CVE-2021-36802
Akaunting DoS via User-Controlled 'locale' Variable
Medium 6.5

Affected Vendor

Affected Software

Akaunting
Vulnerable Versions:
2.1.12

Timeline

Official Publish: August 4th, 2021
Last Modified: September 16th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Weaknesses (CWE)

CWE-94

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1565.002 Stored Data Manipulation
Impact