SourceCodester Online Pizza Ordering System 1.0 /admin/ajax.php username sql injection

EntryHistoryDiffjsonxmlCTI

A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php. The manipulation of the argument username leads to sql injection. Using CWE to declare the problem leads to CWE-89. The weakness was disclosed 03/13/2023. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2023-1365. The attack may be launched remotely. Technical details are available. Furthermore, there is an exploit available. The exploit has been disclosed to the public and may be used. The current price for an exploit might be approx. USD $0-$5k at the moment. The MITRE ATT&CK project declares the attack technique as T1505. It is declared as proof-of-concept. The exploit is available at github.com. As 0-day the estimated underground price was around $0-$5k. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

1	25

Field

source_cve_nvd_summary	1
source_cve_assigned	1
exploit_price_0day	1
vulnerability_cvss3_meta_tempscore	1
vulnerability_cvss3_meta_basescore	1

Commit Conf

90%	31
50%	10
70%	2

Approve Conf

90%	31
80%	10
70%	2

ID	Commited	User	Field	Change	Remarks	Accepted	Status	C
13908741	04/04/2023	VulD...	cve_nvd_summary	A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222872.	cve.mitre.org	04/04/2023	accepted	70
13908740	04/04/2023	VulD...	cve_assigned	1678662000 (03/13/2023)	cve.mitre.org	04/04/2023	accepted	70
13797097	03/13/2023	VulD...	price_0day	$0-$5k	see exploit price documentation	03/13/2023	accepted	90
13797096	03/13/2023	VulD...	cvss3_meta_tempscore	6.6	see CVSS documentation	03/13/2023	accepted	90
13797095	03/13/2023	VulD...	cvss3_meta_basescore	7.3	see CVSS documentation	03/13/2023	accepted	90
13797094	03/13/2023	VulD...	cvss3_vuldb_tempscore	6.6	see CVSS documentation	03/13/2023	accepted	90
13797093	03/13/2023	VulD...	cvss3_vuldb_basescore	7.3	see CVSS documentation	03/13/2023	accepted	90
13797092	03/13/2023	VulD...	cvss2_vuldb_tempscore	6.4	see CVSS documentation	03/13/2023	accepted	90
13797091	03/13/2023	VulD...	cvss2_vuldb_basescore	7.5	see CVSS documentation	03/13/2023	accepted	90
13797090	03/13/2023	VulD...	cvss3_vuldb_rl	X	derived from historical data	03/13/2023	accepted	80
13797089	03/13/2023	VulD...	cvss2_vuldb_rl	ND	derived from historical data	03/13/2023	accepted	80
13797088	03/13/2023	VulD...	cvss2_vuldb_rc	UR	derived from vuldb v3 vector	03/13/2023	accepted	80
13797087	03/13/2023	VulD...	cvss2_vuldb_e	POC	derived from vuldb v3 vector	03/13/2023	accepted	80
13797086	03/13/2023	VulD...	cvss2_vuldb_ai	P	derived from vuldb v3 vector	03/13/2023	accepted	80
13797085	03/13/2023	VulD...	cvss2_vuldb_ii	P	derived from vuldb v3 vector	03/13/2023	accepted	80
13797084	03/13/2023	VulD...	cvss2_vuldb_ci	P	derived from vuldb v3 vector	03/13/2023	accepted	80
13797083	03/13/2023	VulD...	cvss2_vuldb_au	N	derived from vuldb v3 vector	03/13/2023	accepted	80
13797082	03/13/2023	VulD...	cvss2_vuldb_ac	L	derived from vuldb v3 vector	03/13/2023	accepted	80
13797081	03/13/2023	VulD...	cvss2_vuldb_av	N	derived from vuldb v3 vector	03/13/2023	accepted	80
13797080	03/13/2023	VulD...	date	1678662000 (03/13/2023)		03/13/2023	accepted	90

23 more entries are not shown

🔒 Login Required

You need to signup and login to see more of the remaining 23 results.

◂ Previous Overview Next ▸

Do you need the next level of professionalism?

Upgrade your account now!