What’s Vulnerable › Vulnerabilities

CVE-2021-43609

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-11-09 · updated 2026-06-17
• Weakness: CWE-89

Description

An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within the order_by_for_ticket function in app/models/reporting/database_query.rb allows an authenticated attacker to execute arbitrary SQL commands via the sort parameter. This can be leveraged to leak local files from the host system, leading to remote code execution (RCE) through deserialization of malicious data.

Affected products

• Spiceworks Help Desk Server: before 1.3.3 — fixed in 1.3.3

How to fix

Upgrade to a fixed version: Spiceworks Help Desk Server 1.3.3. Check the vendor advisory for mitigations.

References

• https://community.spiceworks.com/blogs/help-desk-server-release-notes/3610-1-3-2-1-3-3
• https://github.com/d5sec/CVE-2021-43609-POC
• https://www.linkedin.com/pulse/cve-2021-43609-write-up-division5-security-4lgwe
• https://community.spiceworks.com/blogs/help-desk-server-release-notes/3610-1-3-2-1-3-3
• https://github.com/d5sec/CVE-2021-43609-POC
• https://www.linkedin.com/pulse/cve-2021-43609-write-up-division5-security-4lgwe

Get alerted when CVE-2021-43609 or the next vulnerability affects your stack