CVE-2021-41765 - CVE House
Back to Database
Status published Critical CVE-2021-41765

A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and...

Vulnerability Description

A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. This allows attackers to uncover the full contents of the ResourceSpace database, including user session cookies. An attacker who gets an admin user session cookie can use the session cookie to execute arbitrary code on the server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41765

Credits & Attribution

No credits recorded in the NVD database.

References

More from montala

View All →
CVE-2022-31260
In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers...
Medium 6.5
CVE-2021-41951
ResourceSpace before 9.6 rev 18290 is affected by a reflected...
Medium 6.1
CVE-2021-41950
A directory traversal issue in ResourceSpace 9.6 before 9.6 rev...
Critical 9.1
CVE-2015-6915
SQL injection vulnerability in Montala Limited ResourceSpace 7.3.7009 and earlier...
High 7.5
CVE-2015-3648
Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before...
High 7.5

Affected Vendor

Affected Software

resourcespace
Vulnerable Versions:
9.5, 9.6

Timeline

Official Publish: November 15th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.