PT-2021-10283 · Unknown · Online Book Store

Liao10086 · Published 2021-05-05 · Updated 2021-05-07 · CVE-2020-19112

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Online Book Store version 1.0

Description: The issue allows a remote malicious user to execute arbitrary code via SQL Injection in the bookisbn parameter to the "admin delete.php" API endpoint. This could potentially lead to unauthorized access and data manipulation.

Recommendations: For Online Book Store version 1.0, consider restricting access to the admin delete.php endpoint until a patch is available, and avoid using the bookisbn parameter in this endpoint to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-19112

Affected Products

Online Book Store

References · 4

• 🔥 https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/13 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-19112 · Security Note
• https://osv.dev/vulnerability/CVE-2020-19112 · Vendor Advisory
• https://t.me/cvenotify/14267 · Telegram Post