PT-2023-17039 · Unknown · Sourcecodester Alphaware Simple E-Commerce System

Wwesleywww · Published 2023-03-20 · Updated 2024-05-17 · CVE-2023-1503

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Alphaware Simple E-Commerce System version 1.0

Description A critical issue has been found in the SourceCodester Alphaware Simple E-Commerce System, affecting an unknown part of the file admin/admin index.php. The manipulation of the username and password arguments with a specific input leads to SQL injection. This can be initiated remotely. The complexity of an attack is rather high, and the exploitability is difficult. The exploit has been disclosed to the public and may be used.

Recommendations For version 1.0, consider temporarily restricting access to the admin/admin index.php file until a patch is available. As a mitigation measure, avoid using the username and password arguments in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-1503

Affected Products

Sourcecodester Alphaware Simple E-Commerce System

References · 6

• 🔥 https://vuldb.com/?id.223407 · Exploit
• 🔥 https://vuldb.com/?ctiid.223407 · Exploit
• https://osv.dev/vulnerability/CVE-2023-1503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1503 · Security Note
• https://t.me/cvenotify/46500 · Telegram Post
• https://t.me/cvenotify/69459 · Telegram Post