PT-2023-17277 · Sourcecodester · Sourcecodester Online Payroll System
Ssl_Seven_Security Lab_Wangzhiqiang_Xiaozilong
·
Published
2023-04-05
·
Updated
2024-05-17
·
CVE-2023-1845
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SourceCodester Online Payroll System version 1.0
Description
A critical issue was found in the SourceCodester Online Payroll System, affecting an unknown part of the file /admin/employee row.php. The manipulation of the
id argument leads to SQL injection. It is possible to initiate the attack remotely. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.
The API endpoint "/admin/employee row.php" is affected, with the id argument being vulnerable to SQL injection.Recommendations
For SourceCodester Online Payroll System version 1.0, consider disabling access to the "/admin/employee row.php" endpoint until a patch is available. Restrict the use of the
id argument in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sourcecodester Online Payroll System