CVE-2021-35458 – Online Pet Shop We App 1.0 contains a critical ... (How to Fix)

Q: What is the severity of CVE-2021-35458?

CVE-2021-35458 has a CVSS score of 9.8 (CRITICAL). Online Pet Shop We App 1.0 contains a critical SQL injection vulnerability in the products.php page via the 'c' or 's' parameters. This allows attackers to execute arbitrary SQL commands, potentially leading to data theft, authentication bypass, or complete system compromise. Any organization running this specific version of the pet shop application is affected.

📋 TL;DR

Online Pet Shop We App 1.0 contains a critical SQL injection vulnerability in the products.php page via the 'c' or 's' parameters. This allows attackers to execute arbitrary SQL commands, potentially leading to data theft, authentication bypass, or complete system compromise. Any organization running this specific version of the pet shop application is affected.

💻 Affected Systems

Products:

Online Pet Shop We App

Versions: 1.0

Operating Systems: Any OS running PHP

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in default installation. Requires PHP environment with database connectivity.

📦 What is this software?

Online Pet Shop We App by Online Pet Shop We App Project

View all CVEs affecting Online Pet Shop We App →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise leading to data exfiltration, authentication bypass, remote code execution via shell upload, and full system takeover.

🟠

Likely Case

Database information disclosure including user credentials, payment information, and sensitive business data, potentially leading to further attacks.

🟢

If Mitigated

Limited impact with proper input validation and parameterized queries preventing SQL injection.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploit code is publicly available and requires minimal technical skill to execute.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Not available

Vendor Advisory: Not available

Restart Required: No

Instructions:

No official patch exists. Remove or replace the vulnerable application with a secure alternative.

🔧 Temporary Workarounds

Input Validation and Sanitization

all

Implement strict input validation and parameterized queries for the 'c' and 's' parameters in products.php

Web Application Firewall (WAF)

all

Deploy a WAF with SQL injection protection rules to block malicious requests

🧯 If You Can't Patch

Immediately take the application offline and replace with secure alternative
Implement network segmentation to isolate the vulnerable system and restrict access

🔍 How to Verify

Check if Vulnerable:

Test products.php with SQL injection payloads in 'c' or 's' parameters (e.g., products.php?c=1' UNION SELECT 1,2,3-- -)

Check Version:

Check application files for version information or review source code comments

Verify Fix Applied:

Verify that SQL injection attempts no longer succeed and that parameterized queries are implemented

📡 Detection & Monitoring

Log Indicators:

Unusual SQL error messages in application logs
Multiple requests with SQL keywords in parameters
Requests to products.php with UNION, SELECT, or other SQL commands

Network Indicators:

HTTP requests containing SQL injection payloads in URL parameters
Unusual database query patterns from web server

SIEM Query:

web.url:*products.php* AND (web.param:*UNION* OR web.param:*SELECT* OR web.param:*--*)

📊 Metadata

CVE ID: CVE-2021-35458

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: July 30, 2021

Last Updated: November 21, 2024

🔗 References

http://packetstormsecurity.com/files/163282/Online-Pet-Shop-We-App-1.0-SQL-Injection-Shell-Upload.html Third Party Advisory,VDB Entry
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-35458 Exploit,Third Party Advisory
https://www.sourcecodester.com/php/14839/online-pet-shop-we-app-using-php-and-paypal-free-source-code.html Product
http://packetstormsecurity.com/files/163282/Online-Pet-Shop-We-App-1.0-SQL-Injection-Shell-Upload.html Third Party Advisory,VDB Entry
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-35458 Exploit,Third Party Advisory
https://www.sourcecodester.com/php/14839/online-pet-shop-we-app-using-php-and-paypal-free-source-code.html Product

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-35458, you might also want to check these: