CVE-2021-44161 Explained : Impact and Mitigation

Changing MOTP (Mobile One Time Password) system's specific function parameter has insufficient validation for user input, leading to a SQL injection vulnerability. This CVE poses a high risk to confidentiality, integrity, and availability.

Understanding CVE-2021-44161

Changing Information Technology Inc. MOTP(Mobile One Time Password) - SQL Injection

What is CVE-2021-44161?

The CVE-2021-44161 vulnerability in Changing MOTP system allows an attacker in the local area network to execute SQL injection attacks, potentially compromising the backend database without authentication.

The Impact of CVE-2021-44161

CVSS Score: 8.8 (High)
Attack Vector: Adjacent Network
Attack Complexity: Low
Confidentiality, Integrity, and Availability Impact: High
An attacker can read, modify, or delete sensitive data in the backend database.

Technical Details of CVE-2021-44161

Vulnerability Description

The vulnerability stems from insufficient validation of user input in a specific function parameter, enabling SQL injection attacks.

Affected Systems and Versions

Affected Product: MOTP(Mobile One Time Password)
Vendor: Changing
Vulnerable Versions: Next of 3.5 (custom version)

Exploitation Mechanism

The attacker needs to be in the local area network to exploit the SQL injection vulnerability in Changing MOTP system.

Mitigation and Prevention

Immediate Steps to Take

Contact tech support from Changing for remediation assistance.

Long-Term Security Practices

Implement input validation and sanitization to prevent SQL injection attacks.
Regularly update and patch the MOTP system to address security vulnerabilities.