CVE-2023-49639 in Billing Software

Riassunto

di MITRE • 04/01/2024

Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'customer_details' parameter of the buyer_invoice_submit.php resource does not validate the characters received and they are sent unfiltered to the database.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Responsabile: Fluid Attacks
• Prenotare: 28/11/2023
• Divulgazione: 04/01/2024
• Moderazione: accettato
• Voce: VDB-249689
• CPE: pronto
• CWE: CWE-89 (confermato)
• CVSS: 9.8 (CNA)
• EPSS: 0.00672
• KEV: no
• Attività: molto basso
• Settore: Finance, Government, ...

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2023-49639
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-49639
• CVE Details: https://www.cvedetails.com/cve/CVE-2023-49639/