Security readout for executives and security teams
Plain-English summary
CVE-2021-4261 is a SQL injection issue in pacman-canvas high score handling. If the game is deployed and still on versions 1.0.0 through 1.0.5, a remote user with required privileges could affect database confidentiality, integrity, and availability.
Executive priority
Prioritize remediation when pacman-canvas is internet-facing or stores meaningful user, score, or operational data. The issue is not marked as known exploited, but SQL injection can create business impact through data exposure, tampering, or service disruption.
Technical view
The affected component is data/db-handler.php, specifically addHighscore. The published CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, scored 6.3. The source bundle identifies upgrade to pacman-canvas 1.0.6, via commit 29522c90ca1cebfce6453a5af5a45281d99b0646, as the fix.
Likely exposure
Exposure is limited to environments running pacman-canvas versions 1.0.0 through 1.0.5 with the high score database feature reachable. The CVSS vector indicates network reachability and low attack complexity, but also requires low privileges.
Exploitation context
The sources say remote exploitation is possible, but KEV is false and the provided bundle does not cite active exploitation in the wild. Treat this as a credible application-layer database risk, not as confirmed mass exploitation.
Researcher notes
The bundle maps this to CWE-707 rather than a narrower SQL injection CWE. Evidence names affected versions and a fixing release, but does not provide exploit telemetry, deployment prevalence, or detailed vendor advisory context.
Mitigation direction
- Upgrade pacman-canvas to version 1.0.6 or later.
- Verify commit 29522c90ca1cebfce6453a5af5a45281d99b0646 is present in deployed code.
- Restrict access to the high score submission path where feasible.
- Review vendor and project guidance before applying local workarounds.
- Back up affected databases before remediation changes.
Validation and detection
- Inventory deployments for pacman-canvas versions 1.0.0 through 1.0.5.
- Confirm whether data/db-handler.php and addHighscore are present and reachable.
- Check deployed release metadata against pacman-canvas 1.0.6.
- Review logs for unusual high score submission activity.
- Run non-destructive regression tests for high score submission after upgrade.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-707: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-4261 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L2.83.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/platzhersh/pacman-canvas/commit/29522c90ca1cebfce6453a5af5a45281d99b0646CVE reference
- https://github.com/platzhersh/pacman-canvas/releases/tag/1.0.6CVE reference
- https://vuldb.com/?id.216270CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization
Improper Neutralization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.