TI-2021-18896 Aliases CVE-2021-42668 GHSA-6rv5-2rfw-cjj8

A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via…

MEDIUM 50CWE-89Published 2021-11-05 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_classmates.php web page.. As a result, an attacker can extract sensitive data from the web server and in some cases can use this vulnerability in order to get a remote code execution on the remote web server.

Why it matters now

EPSS 0.04767 91st percentileScored 2026-11-07

Public exploit Yes 3 exploit referencesTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:engineers_online_portal_project:engineers_online_portal:-:::::::*	not specified by NVD	Vulnerable	Engineers Online Portal Project

cpe:2.3:a:engineers_online_portal_project:engineers_online_portal:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Engineers Online Portal Project

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-42668
2026-10-03 Alias added: GHSA-6rv5-2rfw-cjj8

References

Exploit 3

Advisory 1

https://www.sourcecodester.com/php/13115/engineers-online-portal-php.html

TI-2023-04857 SourceCodester Engineers Online Portal remove_inbox_message.php sql injection CVSS 3.1CRITICAL 9.8
TI-2023-04855 SourceCodester Engineers Online Portal my_classmates.php sql injection CVSS 3.1CRITICAL 9.8
TI-2023-04858 SourceCodester Engineers Online Portal seed_message_student.php sql injection CVSS 3.1CRITICAL 9.8
TI-2023-04854 SourceCodester Engineers Online Portal login.php sql injection CVSS 3.1CRITICAL 9.8
TI-2023-04853 SourceCodester Engineers Online Portal student_avatar.php unrestricted upload CVSS 3.1CRITICAL 9.8
TI-2023-04852 SourceCodester Engineers Online Portal downloadable_student.php sql injection CVSS 3.1CRITICAL 9.8

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences