PT-2023-24397 · Sourcecodester · Sourcecodester Enrollment System Project

Sudovivek + 1 · Publicado 2023-06-21 · Atualizado 2024-08-01 · CVE-2023-33584

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Enrollment System Project version V1.0

Description The issue concerns SQL Injection (SQLI) attacks, which allow an attacker to manipulate the SQL queries executed by the application. This is due to the application's failure to properly validate user-supplied input in the username and password fields during the login process, enabling an attacker to inject malicious SQL code.

Recommendations For Sourcecodester Enrollment System Project version V1.0, consider implementing proper input validation and sanitization for the username and password fields to prevent SQL injection attacks. As a temporary workaround, restrict access to the login functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-33584

Produtos afetados

Sourcecodester Enrollment System Project

Referências · 10

• 🔥 http://packetstormsecurity.com/files/172718/Enrollment-System-Project-1.0-Authentication-Bypass-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/51501 · Exploit
• 🔥 https://github.com/sudovivek/CVE/blob/main/CVE-2023-33584/CVE-2023-33584.txt · Exploit
• 🔥 https://github.com/sudovivek/My-CVE/blob/main/CVE-2023-33584_exploit.md · Exploit
• https://t.me/cvenotify/52788 · Publicação no Telegram
• https://t.me/cvenotify/77695 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-33584 · Nota de Segurança
• https://sourcecodester.com/php/14444/enrollment-system-project-source-code-using-phpmysql.html · Nota
• https://osv.dev/vulnerability/CVE-2023-33584 · Aviso do Fabricante
• https://packetstormsecurity.com/files/cve/CVE-2023-33584 · Nota