Rowan

**Name of the Vulnerable Software and Affected Versions** Campcodes Retro Basketball Shoes Online Store version 1.0 **Description** A flaw exists in Campcodes Retro Basketball Shoes Online Store version 1.0 that allows for SQL injection. The issue is located in the file `/admin/admin running.php` within an unknown function. Manipulation of the `pid` argument can trigger the injection, and the attack can be initiated remotely. The exploit has been published. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Best Salon Management System version 1.0 **Description** A SQL injection issue exists in the software due to improper handling of user-supplied input. Specifically, manipulating the `editid` parameter in the `/panel/edit-appointment.php` script can lead to arbitrary SQL execution. The exploit is publicly available. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Campcodes Online Learning Management System version 1.0 **Description** A SQL Injection issue exists in Campcodes Online Learning Management System version 1.0. The flaw is located within the `/admin/calendar of events.php` script, where the `date start` parameter can be manipulated to inject malicious SQL code. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to data leakage, data corruption, or unauthorized access. The exploit is publicly available. **Recommendations** Apply a fix for Campcodes Online Learning Management System version 1.0. As a temporary workaround, restrict access to the `/admin/calendar of events.php` script. Avoid using the `date start` parameter in the affected API endpoint until the issue is resolved.