CVE-2023-1351
SourceCodester Computer Parts Sales and Inventory System cust_transac.php sql injection
- State
- Published
- Severity
- 6.3 Medium
- Published
- Mar 11, 2023
- Updated
- Aug 2, 2024
- Reserved
- Mar 11, 2023
Description
A vulnerability classified as critical has been found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects an unknown part of the file cust_transac.php. The manipulation of the argument phonenumber leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222849 was assigned to this vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P | VulDB |
Weaknesses
- CWE-89 SQL Injection
Affected Products
| Product | Versions |
|---|---|
Computer Parts Sales and Inventory SystemSourceCodester |
|
References
- https://vuldb.com/?id.222849vdb-entrytechnical-description
- https://vuldb.com/?ctiid.222849signaturepermissions-required
- https://github.com/chenxing0903/CveHub/blob/main/Computer-Parts-Sales-And-Inventory-System-Sql-Vulnerability.pdfexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.