CVE-2021-41765: ResourceSpace unauthenticated SQL injection in add_keyword.php

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, high EPSS, and a documented exploit reference make this an urgent patch target.

What it is

ResourceSpace 9.5 and 9.6 before rev 18274 contains a SQL injection flaw in pages/edit_fields/9_ajax/add_keyword.php reachable through the k parameter. Because the endpoint is unauthenticated, an attacker can read the full database, including user session cookies, and an admin session cookie then enables code execution on the server.

Impact

An attacker gains full read access to the ResourceSpace database, including session cookies, and can escalate to arbitrary code execution on the server by reusing a stolen admin session.

Attack surface

Reached remotely over the network via the k parameter of the add_keyword.php endpoint; the CVSS vector shows no privileges and no user interaction required, so it is unauthenticated.

Exploitation

Not listed in CISA KEV, but EPSS is 0.67845 (99.283 percentile) and a third-party reference is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade ResourceSpace to revision 18274 or later, or the current supported release.
• If patching is delayed, restrict network access to pages/edit_fields/9_ajax/add_keyword.php and the edit_fields AJAX endpoints.
• Rotate all user and admin session cookies and invalidate active sessions after patching.
• Apply input validation or parameterized queries to the k parameter as a temporary code-level fix.
• Review database and web server logs for prior exploitation attempts.

Detection

• Search web logs for requests to pages/edit_fields/9_ajax/add_keyword.php with suspicious or SQL-like k parameter values.
• Alert on SQL error strings or unexpected query patterns in ResourceSpace application and database logs.
• Monitor for anomalous admin session activity or logins from new source addresses.
• Watch for outbound connections or process spawning from the web server that could indicate post-exploitation code execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.