CVE-2021-28022 describes a blind SQL injection vulnerability in the login form of ServiceTonic Helpdesk software versions prior to 9.0.35937. An unauthenticated attacker can exploit this flaw to exfiltrate sensitive information using specially crafted, HQL-compatible time-based SQL queries. This vulnerability carries a CVSSv3.1 score of 7.5 (HIGH), indicating a network-exploitable flaw with low attack complexity and high impact on confidentiality, but no impact on integrity or availability. While no public exploits (Metasploit, Nuclei, ExploitDB) or active exploitation in the wild (KEV) have been identified, and community discussion and media coverage are minimal, the potential for data exfiltration remains a significant concern.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 9.0.035937CPE matchmatch criteria | cpe:2.3:a:servicetonic:servicetonic:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.