TI-2021-18898 Aliases CVE-2021-42670 GHSA-mw79-98hv-j43p

A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via…

MEDIUM 53CWE-89Published 2021-11-05 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcements_student.php web page. As a result a malicious user can extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remote web server.

Why it matters now

EPSS 0.08415 95th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:engineers_online_portal_project:engineers_online_portal:-:::::::*	not specified by NVD	Vulnerable	Engineers Online Portal Project

cpe:2.3:a:engineers_online_portal_project:engineers_online_portal:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Engineers Online Portal Project

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-42670
2026-10-03 Alias added: GHSA-mw79-98hv-j43p
2026-11-04 EPSS moved to the 95th–99th percentile

References

Exploit 2

Advisory 1

https://www.sourcecodester.com/php/13115/engineers-online-portal-php.html

TI-2023-04857 SourceCodester Engineers Online Portal remove_inbox_message.php sql injection CVSS 3.1CRITICAL 9.8
TI-2023-04855 SourceCodester Engineers Online Portal my_classmates.php sql injection CVSS 3.1CRITICAL 9.8
TI-2023-04858 SourceCodester Engineers Online Portal seed_message_student.php sql injection CVSS 3.1CRITICAL 9.8
TI-2023-04854 SourceCodester Engineers Online Portal login.php sql injection CVSS 3.1CRITICAL 9.8
TI-2023-04853 SourceCodester Engineers Online Portal student_avatar.php unrestricted upload CVSS 3.1CRITICAL 9.8
TI-2023-04852 SourceCodester Engineers Online Portal downloadable_student.php sql injection CVSS 3.1CRITICAL 9.8

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences