CVE-2021-22854

CVE-2021-22854 describes a critical SQL injection vulnerability in the HR Portal of Soar Cloud System, specifically affecting the hr_portal_project hr_portal product. This flaw allows unauthenticated remote attackers to inject SQL syntax due to insufficient parameter filtering, leading to the complete exfiltration of all database contents without requiring any privileges. Rated with a CVSS score of 7.5 (HIGH), the vulnerability is easily exploitable over the network with low attack complexity and has a high impact on confidentiality. While there is no evidence of active exploitation, nor publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the lack of community discussion or media coverage is typical for the vast majority of CVEs.