PT-2023-17368 · Unknown · Sourcecodester Online Computer/Laptop Store

Haicheng.Zhang · Publicado 2023-04-08 · Atualizado 2024-05-17 · CVE-2023-1955

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Online Computer and Laptop Store version 1.0

Description A critical vulnerability has been found in the User Registration component of the affected software. The issue is related to the manipulation of the email argument in an unknown function of the file login.php, leading to sql injection. This can be exploited remotely. The exploit has been disclosed to the public.

Recommendations For version 1.0, consider disabling the User Registration component or restricting access to the login.php file until a patch is available. As a temporary workaround, avoid using the email argument in the affected function to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-1955

Produtos afetados

Sourcecodester Online Computer/Laptop Store

Referências · 7

• 🔥❌ https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/User%20registration%20SQL%20injection.pdf · Exploit, Deleted
• https://vuldb.com/?id.225342 · Nota
• https://t.me/cibsecurity/61710 · Publicação no Telegram
• https://vuldb.com/?ctiid.225342 · Nota
• https://t.me/cvenotify/47814 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-1955 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-1955 · Nota de Segurança