pentester.land· Jan 15, 2022· by 0xkasper (@0xkasper)🔍 CVE-2021-36393

Moodle: Blind SQL Injection (CVE-2021-36393) and Broken Access Control (CVE-2021-36397)

Open Original Article ↗
Target Program: Moodle
🎯 Vulnerability: SQL Injection (SQLi)
💡 Defense Fix: Use Parameterized Prepared Statements (ORM) for all database queries and disable verbose error messages.
#SQL injection#Broken Access Control#CVE-2021-36393#CVE-2021-36397

More Writeups Like This

pentester.land

CVE-2021-4119: [Bookstack] Email harvesting via SQL "LIKE" clause exploitation

by Haxatron (@Haxatron1)
pentester.land

120 Days of High Frequency Hunting

by Kuldeep Pandya (@kuldeepdotexe), Sam Paredes (@caffeinevulns)
pentester.land

My write-up in hacking IBM’s administration panel and getting SQLi on it

by Momen Ali (Cyber Guy) (@theCyberGuy0)
pentester.land

Optimizing Hunting Results in VDP for use in Bug Bounty Programs - From Sensitive Information Disclosure to Accessing Hidden APIs which can be used to Retrieve Customer Data

by YoKo Kho (@YokoAcc)