PT-2023-8556 · Sourcecodester · Sourcecodester Medical Certificate Generator App

Gab3 + 1 · Publicado 2023-02-10 · Atualizado 2024-05-17 · CVE-2023-0774

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SourceCodester Medical Certificate Generator App version 1.0

Description The issue is related to a lack of protection against SQL query structure exploitation in the action.php script of the Medical Certificate Generator App. This allows a remote attacker to execute arbitrary SQL code by manipulating the lastname argument, leading to a SQL injection attack.

Recommendations For SourceCodester Medical Certificate Generator App version 1.0, consider disabling the action.php script or restricting access to it until a patch is available to prevent SQL injection attacks. Additionally, avoid using the lastname argument in the affected script until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2024-01163

CVE-2023-0774

Produtos afetados

Sourcecodester Medical Certificate Generator App

Referências · 7

• 🔥 https://youtube.com/watch?v=s3oK5jebx_I · Exploit
• https://osv.dev/vulnerability/CVE-2023-0774 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-0774 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-01163 · Nota de Segurança
• https://vuldb.com/?ctiid.220558 · Nota
• https://vuldb.com/?id.220558 · Nota
• https://t.me/cibsecurity/57892 · Publicação no Telegram