CVE-2021-43609 is a Blind Boolean SQL injection vulnerability affecting Spiceworks Help Desk Server versions prior to 1.3.3. An authenticated attacker can exploit this flaw via the sort parameter in the order_by_for_ticket function to execute arbitrary SQL commands. This vulnerability carries a high CVSS score of 8.8, indicating a significant risk of data compromise, integrity loss, and availability impact, as it can lead to local file leakage and potential remote code execution through deserialization. While no active exploitation, public exploit code, or significant community discussion has been observed, the potential for severe impact necessitates prompt patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.3.3CPE matchmatch criteria | cpe:2.3:a:spiceworks:help_desk_server:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.