PT-2023-17392 · Unknown · Sourcecodester Online Computer/Laptop Store

Ddea · Publicado 2023-04-11 · Atualizado 2024-05-17 · CVE-2023-1985

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Online Computer and Laptop Store version 1.0

Description A critical issue has been found in the function save brand of the file /classes/Master.php?f=save brand. The manipulation of the argument name leads to sql injection. The attack may be initiated remotely.

Recommendations For version 1.0, consider disabling the save brand function until a patch is available to prevent sql injection attacks. Restrict access to the /classes/Master.php?f=save brand endpoint to minimize the risk of exploitation. Avoid using the name argument in the affected endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-1985

Produtos afetados

Sourcecodester Online Computer/Laptop Store

Referências · 7

• 🔥❌ https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/1-SQL%20injection%20exists%20at%20the%20location%20where%20the%20brand%20list%20is%20added.pdf · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2023-1985 · Nota de Segurança
• https://vuldb.com/?id.225533 · Nota
• https://t.me/cibsecurity/61904 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-1985 · Aviso do Fabricante
• https://t.me/cvenotify/48178 · Publicação no Telegram
• https://vuldb.com/?ctiid.225533 · Nota