Abxery

**Name of the Vulnerable Software and Affected Versions** itsourcecode COVID Tracking System version 1.0 **Description** A flaw exists in itsourcecode COVID Tracking System version 1.0 that allows for remote SQL injection. The issue is located in the file `/admin/?page=establishment`, where manipulation of the `ID` argument can trigger the injection. The exploit is publicly available. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** COVID Tracking System version 1.0 **Description** A flaw exists in the COVID Tracking System that allows for SQL injection. The issue is located in the file `/admin/?page=people` and involves manipulation of the `ID` argument. This can be initiated remotely. The exploit has been published. The vulnerable function is unknown. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Campcodes Complete Online Beauty Parlor Management System version 1.0 **Description** A cross site scripting issue exists in Campcodes Complete Online Beauty Parlor Management System 1.0. The issue is located in the file `/admin/customer-list.php`. Manipulation of the `Name` argument can lead to the execution of malicious scripts. The exploit is publicly available. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Campcodes Retro Basketball Shoes Online Store version 1.0 **Description** A flaw exists in Campcodes Retro Basketball Shoes Online Store version 1.0 that allows for unrestricted file upload. This is due to manipulation of the `product image` argument within an unknown function of the `/admin/admin product.php` file. The attack can be launched remotely. The exploit has been published. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Courier Management System version 1.0 **Description** A flaw exists in Courier Management System 1.0 that allows for remote code execution through SQL injection. The issue is located in the `/courier/edit-courier.php` file, specifically when manipulating the `OfficeName` argument. The publicly available exploit may be used to compromise systems. **Recommendations** Apply a fix to address the SQL injection issue in the `/courier/edit-courier.php` file when handling the `OfficeName` argument.