.. / CVE-2021-31856

• SQLi
• Nuclei
• Web

Exploit for Layer5 Meshery 0.5.2 - SQL Injection (CVE-2021-31856)

Description:

Layer5 Meshery 0.5.2 contains a SQL injection vulnerability in the REST API that allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go).

Nuclei Template

View the template here CVE-2021-31856.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-31856.yaml

References: