PT-2023-16608 · Unknown · Sourcecodester Online Pizza Ordering System

Qnsx · Published 2023-02-18 · Updated 2024-05-17 · CVE-2023-0906

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Online Pizza Ordering System version 1.0

Description A critical issue was found in the function delete category of the file ajax.php of the component POST Parameter Handler, leading to missing authentication. The attack can be launched remotely.

Recommendations For SourceCodester Online Pizza Ordering System version 1.0, as a temporary workaround, consider disabling the delete category function until a patch is available. Restrict access to the ajax.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2023-0906

Affected Products

Sourcecodester Online Pizza Ordering System

References · 5

• https://osv.dev/vulnerability/CVE-2023-0906 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0906 · Security Note
• https://vuldb.com/?ctiid.221455 · Note
• https://vuldb.com/?id.221455 · Note
• https://t.me/cvenotify/44631 · Telegram Post