CVE-2023-4407

MEDIUM

Credit Lite 1.5.4 - SQL Injection via POST Request Handler

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-4407. PoCs published by CraCkEr.

AI-analyzed exploit summary This exploit demonstrates a time-based blind SQL injection vulnerability in Credit Lite 1.5.4 via the 'date1' and 'date2' POST parameters. The payload uses MySQL SLEEP functions to confirm the vulnerability.

Description

A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4. Affected by this vulnerability is an unknown functionality of the file /portal/reports/account_statement of the component POST Request Handler. The manipulation of the argument date1/date2 leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-237511.

Exploits (1)

exploitdb WORKING POC
by CraCkEr · textwebappsphp
https://www.exploit-db.com/exploits/51701

This exploit demonstrates a time-based blind SQL injection vulnerability in Credit Lite 1.5.4 via the 'date1' and 'date2' POST parameters. The payload uses MySQL SLEEP functions to confirm the vulnerability.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Credit Lite 1.5.4
Auth required
Prerequisites: Access to the application's account statement page · Valid session token
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Permissions Required, Third Party Advisory vdb-entry technical-description
https://vuldb.com/?id.237511
Permissions Required, Third Party Advisory signature permissions-required
https://vuldb.com/?ctiid.237511

Scores

CVSS v3 6.3
EPSS 0.0007
EPSS Percentile 22.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Details

CWE
CWE-89
Status published
Products (1)
credit_lite_project/credit_lite 1.5.4
Published Aug 18, 2023
Tracked Since Feb 18, 2026