CVE-2023-2130

MEDIUMNuclei

SourceCodester Purchase Order Management System GET Parameter view_details.php sql injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-2130 has a selected CVSS score of 6.3 (medium); EIP currently links 1 Nuclei template.

Description

A vulnerability classified as critical has been found in SourceCodester Purchase Order Management System 1.0. Affected is an unknown function of the file /admin/suppliers/view_details.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226206 is the identifier assigned to this vulnerability.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Purchase Order Management System

Browse SourceCodester / Purchase Order Management System
CVE List1.0affected

Nuclei templates

1
ProjectDiscoveryCRITICALPurchase Order Management v1.0 - SQL InjectionCVSS 9.8

A vulnerability classified as critical has been found in SourceCodester Purchase Order Management System 1.0. Affected is an unknown function of the file /admin/suppliers/view_details.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226206 is the identifier assigned to this vulnerability.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Upgrade to the latest version to mitigate this vulnerability.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicve2023cvesqlipurchase-order-management-systempurchase_order_management_system_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:purchase_order_management_system_project:purchase_order_management_system:1.0:*:*:*:*:*:*:*
https://github.com/zitozito1/bug_report/blob/main/SQLi.md https://www.sourcecodester.com/php/14935/purchase-order-management-system-using-php-free-source-code.html https://nvd.nist.gov/vuln/detail/CVE-2023-2130 https://vuldb.com/?ctiid.226206 https://vuldb.com/?id.226206

Source: ProjectDiscovery

References

4