{"id":"CVE-2021-37371","aliases":["CLSA-2024-1727287657","CLSA-2024-1727288271","EUVD-2021-23940","GHSA-5qv6-29gp-g285"],"status":"published","title":"Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass...","description":"Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login.php.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.0219,"percentile":0.82697,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2021-10-26T12:12:34Z","modified":"2026-06-17T04:00:25Z","affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-admin-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-gss-samples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-k5tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-kdc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-kdc-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-locales","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-multidev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-otp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-pkinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libgssapi-krb5-2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libgssrpc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libk5crypto3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkadm5clnt-mit9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkadm5srv-mit9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkdb5-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkrad-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkrad0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkrb5-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkrb5-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkrb5support0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-admin-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-gss-samples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-k5tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-kdc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-kdc-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-kpropd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-locales","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-multidev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-otp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-pkinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgssapi-krb5-2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgssrpc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libk5crypto3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkadm5clnt-mit11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkadm5srv-mit11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkdb5-9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkrad-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkrad0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkrb5-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkrb5-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkrb5support0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4}],"products":[{"vendor":"online_student_admission_system_project","product":"online_student_admission_system"}],"references":[{"url":"https://www.sourcecodester.com/php/14874/online-student-admission-system.html","tags":["x_refsource_MISC","x_transferred","Product"]},{"url":"http://packetstormsecurity.com/files/164625/Online-Student-Admission-System-1.0-SQL-Injection-Shell-Upload.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://packetstormsecurity.com/files/164625/Online_Admission_System_CVEs-Gerard-Carbonell.pdf","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37371"},{"url":"https://github.com/advisories/GHSA-5qv6-29gp-g285"},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1727287657.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2024-1727288271.html","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-37371","description":"Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login.php.","status":"published","published":"2021-10-26T12:12:34Z","modified":"2024-08-04T01:16:03.712Z","updated_at":"2026-11-02T14:32:58.359368Z"}],"euvd":[{"id":"EUVD-2021-23940","description":"Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login.php.","status":"published","published":"2021-10-26T12:12:34Z","modified":"2024-08-04T01:16:03Z","updated_at":"2026-11-03T03:24:27.725787Z"}],"ghsa":[{"id":"GHSA-5qv6-29gp-g285","title":"Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass...","description":"Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login.php.","status":"published","published":"2022-05-24T19:18:49Z","modified":"2023-01-30T05:03:00Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:46:45.069338Z"}],"nvd":[{"id":"CVE-2021-37371","description":"Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login.php.","status":"published","published":"2021-10-26T13:15:07.463Z","modified":"2026-06-17T04:00:25.003Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:07:00.549994Z"}],"osv":[{"id":"CLSA-2024-1727287657","title":"Fix CVE(s): CVE-2021-37370, CVE-2021-37371, CVE-2024-37370, CVE-2024-37371","description":"   * SECURITY UPDATE: fix GSS vulnerabilities\n     - debian/patches/CVE-2021-37370.patch: prevent modification of Extra\n       Count field in GSS krb5 wrap CFX wrap token to avoid appearing\n       truncated to application header\n     - debian/patches/CVE-2021-37371.patch: fix invalid memory reads\n       during GSS message token handling\n     - CVE-2024-37370\n     - CVE-2024-37371","status":"published","published":"2024-09-25T18:07:40Z","modified":"2026-06-04T10:04:11.844482Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1727288271","title":"Fix CVE(s): CVE-2021-37370, CVE-2021-37371, CVE-2024-37370, CVE-2024-37371","description":"   * SECURITY UPDATE: fix GSS vulnerabilities\n     - debian/patches/CVE-2021-37370.patch: prevent modification of Extra\n       Count field in GSS krb5 wrap CFX wrap token to avoid appearing\n       truncated to application header\n     - debian/patches/CVE-2021-37371.patch: fix invalid memory reads\n       during GSS message token handling\n     - CVE-2024-37370\n     - CVE-2024-37371","status":"published","published":"2024-09-25T18:17:56Z","modified":"2026-06-04T10:04:07.389502Z","updated_at":"2026-11-02T15:43:41.281406Z"}]}}