PT-2023-1589 · Sourcecodester · Sourcecodester Medical Certificate Generator App

P1Nk · Published 2023-02-07 · Updated 2024-05-17 · CVE-2023-0706

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SourceCodester Medical Certificate Generator App version 1.0

Description A critical issue has been found in the manage record.php file of the SourceCodester Medical Certificate Generator App, related to the incorrect neutralization of special elements in output. The manipulation of the id argument leads to SQL injection. This issue can be exploited remotely, allowing an attacker to execute arbitrary SQL code.

Recommendations For version 1.0, consider disabling the manage record.php file or restricting access to it until a patch is available. As a temporary workaround, avoid using the id argument in the affected functionality to minimize the risk of exploitation.

Fix

Special Elements Injection

Improper Neutralization

SQL injection

Weakness Enumeration

CWE-74

CWE-707

CWE-89

Related Identifiers

BDU:2023-01083

CVE-2023-0706

Affected Products

Sourcecodester Medical Certificate Generator App

References · 6

• https://osv.dev/vulnerability/CVE-2023-0706 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01083 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-0706 · Security Note
• https://vuldb.com/?id.220340 · Note
• https://t.me/cvenotify/43757 · Telegram Post
• https://vuldb.com/?ctiid.220340 · Note