PT-2023-16608 · Unknown · Sourcecodester Online Pizza Ordering System

Qnsx · Publicado 2023-02-18 · Atualizado 2024-05-17 · CVE-2023-0906

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Online Pizza Ordering System version 1.0

Description A critical issue was found in the function delete category of the file ajax.php of the component POST Parameter Handler, leading to missing authentication. The attack can be launched remotely.

Recommendations For SourceCodester Online Pizza Ordering System version 1.0, as a temporary workaround, consider disabling the delete category function until a patch is available. Restrict access to the ajax.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2023-0906

Produtos afetados

Sourcecodester Online Pizza Ordering System

Referências · 5

• https://osv.dev/vulnerability/CVE-2023-0906 · Aviso do Fabricante
• https://vuldb.com/?ctiid.221455 · Nota
• https://vuldb.com/?id.221455 · Nota
• https://t.me/cvenotify/44631 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0906 · Nota de Segurança