PT-2023-25756 · Unknown · Food Ordering System

Okan Kurtuluş · Publicado 2023-07-06 · Atualizado 2023-07-10 · CVE-2023-36968

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Food Ordering System version 1.0

Description A SQL Injection issue allows attackers to execute commands on the database by sending crafted SQL queries to the ID parameter.

Recommendations For Food Ordering System version 1.0, avoid using the ID parameter in SQL queries until a fix is available. Consider implementing input validation and sanitization for the ID parameter to prevent malicious SQL queries.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-36968

Produtos afetados

Food Ordering System

Referências · 4

• 🔥 https://okankurtulus.com.tr/2023/06/21/food-ordering-system-v1-0-authenticated-sql-injection · Exploit
• https://github.com/haxxorsid/food-ordering-system · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-36968 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-36968 · Aviso do Fabricante