PT-2020-16931 · Sourcecodester · Sourcecodester Simple Grocery Store Sales/Inventory System

Published 2020-11-17 · Updated 2020-12-09 · CVE-2020-28133

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Grocery Store Sales And Inventory System version 1.0

Description An issue was discovered in the web login functionality, allowing authentication bypass. This enables an attacker to gain client privileges via SQL injection in the sales inventory/login.php file.

Recommendations For version 1.0, consider disabling the login functionality in sales inventory/login.php until a patch is available to prevent SQL injection attacks. Restrict access to the sales inventory/login.php file to minimize the risk of exploitation. Avoid using the login functionality in the affected version until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-28133

Affected Products

Sourcecodester Simple Grocery Store Sales/Inventory System

References · 7

• 🔥 https://exploit-db.com/exploits/48879 · Exploit
• https://osv.dev/vulnerability/CVE-2020-28133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28133 · Security Note
• https://t.me/cibsecurity/17354 · Telegram Post
• https://sourcecodester.com/php/14461/simple-grocery-store-sales-and-inventory-system-using-phpmysql-source-code.html · Note
• https://t.me/cibsecurity/16470 · Telegram Post
• https://t.me/cvenotify/5734 · Telegram Post