PT-2020-15657 · Sourcecodester · Sourcecodester Online Shopping Alphaware

Published 2020-08-17 · Updated 2020-08-21 · CVE-2020-24208

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Online Shopping Alphaware version 1.0

Description A SQL injection issue allows remote unauthenticated attackers to bypass the authentication process. This is achieved via the email and password parameters.

Recommendations For SourceCodester Online Shopping Alphaware version 1.0, consider restricting access to the authentication module to minimize the risk of exploitation until a patch is available. Avoid using the email and password parameters in a way that could be exploited by attackers. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-24208

Affected Products

Sourcecodester Online Shopping Alphaware

References · 5

• https://osv.dev/vulnerability/CVE-2020-24208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24208 · Security Note
• https://exploit-db.com/exploits/48725 · Note
• https://packetstormsecurity.com/files/158684/Online-Shopping-Alphaware-1.0-SQL-Injection.html · Note
• https://sourcecodester.com/download-code?nid=14368&title=Online+Shopping+Alphaware+in+PHP%2FMysql · Note