SourceCodester Alphaware Simple E-Commerce System 1.0 edit_customer.php firstname/mi/lastname sql injection

Podatność, która została odkryta w SourceCodester Alphaware Simple E-Commerce System 1.0. Problemem dotknięta jest nieznana funkcja w pliku function/edit_customer.php. Dzięki manipulowaniu argumentem firstname/mi/lastname wartością wejściową a' RLIKE SLEEP(5) AND 'dAbu'='dAbu przy użyciu nieznanych danych wejściowych można doprowadzić do wystąpienia podatności sql injection. Podatność ta jest znana jako CVE-2023-1502. Możliwe jest zdalne zainicjowanie ataku. Techniczne szczegóły są znane. Uważa się go za proof-of-concept. Potencjalne zabezpieczenie zostało opublikowane jeszcze przed po ujawnieniu podatności.

Pole2023-04-12 02:122023-04-12 02:202023-04-12 02:27
vendorSourceCodesterSourceCodesterSourceCodester
nameAlphaware Simple E-Commerce SystemAlphaware Simple E-Commerce SystemAlphaware Simple E-Commerce System
version1.01.01.0
filefunction/edit_customer.phpfunction/edit_customer.phpfunction/edit_customer.php
argumentfirstname/mi/lastnamefirstname/mi/lastnamefirstname/mi/lastname
input_valuea' RLIKE SLEEP(5) AND 'dAbu'='dAbua' RLIKE SLEEP(5) AND 'dAbu'='dAbua' RLIKE SLEEP(5) AND 'dAbu'='dAbu
cwe89 (sql injection)89 (sql injection)89 (sql injection)
risk222
cvss3_vuldb_avNNN
cvss3_vuldb_acHHH
cvss3_vuldb_prNNN
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_ePPP
cvss3_vuldb_rcRRR
availability111
publicity111
cveCVE-2023-1502CVE-2023-1502CVE-2023-1502
responsibleVulDBVulDBVulDB
date1679266800 (2023-03-20)1679266800 (2023-03-20)1679266800 (2023-03-20)
typeE-Commerce Management SoftwareE-Commerce Management SoftwareE-Commerce Management Software
cvss2_vuldb_avNNN
cvss2_vuldb_acHHH
cvss2_vuldb_auNNN
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rcURURUR
cvss2_vuldb_rlNDNDND
cvss3_vuldb_rlXXX
cvss2_vuldb_basescore5.15.15.1
cvss2_vuldb_tempscore4.44.44.4
cvss3_vuldb_basescore5.65.65.6
cvss3_vuldb_tempscore5.15.15.1
cvss3_meta_basescore5.67.07.0
cvss3_meta_tempscore5.16.86.8
price_0day$0-$5k$0-$5k$0-$5k
cve_assigned1679266800 (2023-03-20)1679266800 (2023-03-20)1679266800 (2023-03-20)
cve_nvd_summaryA vulnerability was found in SourceCodester Alphaware Simple E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file function/edit_customer.php. The manipulation of the argument firstname/mi/lastname with the input a' RLIKE SLEEP(5) AND 'dAbu'='dAbu leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-223406 is the identifier assigned to this vulnerability.A vulnerability was found in SourceCodester Alphaware Simple E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file function/edit_customer.php. The manipulation of the argument firstname/mi/lastname with the input a' RLIKE SLEEP(5) AND 'dAbu'='dAbu leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-223406 is the identifier assigned to this vulnerability.A vulnerability was found in SourceCodester Alphaware Simple E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file function/edit_customer.php. The manipulation of the argument firstname/mi/lastname with the input a' RLIKE SLEEP(5) AND 'dAbu'='dAbu leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-223406 is the identifier assigned to this vulnerability.
cvss3_nvd_avNN
cvss3_nvd_acLL
cvss3_nvd_prNN
cvss3_nvd_uiNN
cvss3_nvd_sUU
cvss3_nvd_cHH
cvss3_nvd_iHH
cvss3_nvd_aHH
cvss2_nvd_avNN
cvss2_nvd_acHH
cvss2_nvd_auNN
cvss2_nvd_ciPP
cvss2_nvd_iiPP
cvss2_nvd_aiPP
cvss3_cna_avNN
cvss3_cna_acHH
cvss3_cna_prNN
cvss3_cna_uiNN
cvss3_cna_sUU
cvss3_cna_cLL
cvss3_cna_iLL
cvss3_cna_aLL
cve_cnaVulDBVulDB
cvss2_nvd_basescore5.15.1
cvss3_nvd_basescore9.89.8
cvss3_cna_basescore5.65.6

◂ PoprzedniPrzeglądKolejny ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!