CVE-2021-36385 | BDVDB-2026-159557 Detail

Description#

A SQL Injection vulnerability in Cerner Mobile Care 5.0.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via a Fullwidth Apostrophe (aka U+FF07) in the default.aspx User ID field. Arbitrary system commands can be executed through the use of xp_cmdshell.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.blacklanternsecurity.com/blog/
https://www.cerner.com/solutions/mobility
https://www.blacklanternsecurity.com/2021-08-13-Cerner-MobileCare-CVE/

Exploit#

No public exploit known

History#

Version 12021-08-24Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.