SQL Injection Vulnerability in TripSpark VEO Transportation by TripSpark
CVE-2021-3262

9.8CRITICAL

Key Information:

Vendor

Trispark

Status
Novusedu
Veo Transportation
Vendor
CVE Published:
29 August 2023

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2021-3262?

The TripSpark VEO Transportation and NovusEDU products are vulnerable due to improper handling of user inputs in POST body parameters. This allows malicious users to inject arbitrary SQL commands into the 'Student Busing Information' search queries. The lack of sanitization on server-side logic makes these systems susceptible to SQL injection attacks, potentially compromising sensitive data and system integrity.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-3262
Created by l0lsec

References

https://susos.co/blog/f/cve-disclosureuncovered-sql-injec...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.