PT-2023-17365 · Unknown · Sourcecodester Online Computer/Laptop Store

Haicheng.Zhang · Published 2023-04-08 · Updated 2024-05-17 · CVE-2023-1952

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Online Computer and Laptop Store version 1.0

Description A critical issue has been found in the Product Search component, specifically affecting the file /?p=products. The search argument is vulnerable to sql injection, allowing for remote attacks. The exploit has been publicly disclosed.

Recommendations For version 1.0, as a temporary workaround, consider restricting access to the /api/v1/products endpoint or disabling the search argument in the Product Search component until a patch is available. Avoid using the search argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-1952

Affected Products

Sourcecodester Online Computer/Laptop Store

References · 7

• 🔥❌ https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/SQL%20injection%20exists%20in%20the%20search%20bar%20on%20the%20homepage.pdf · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2023-1952 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1952 · Vendor Advisory
• https://vuldb.com/?ctiid.225339 · Note
• https://t.me/cvenotify/48034 · Telegram Post
• https://t.me/cvenotify/47810 · Telegram Post
• https://vuldb.com/?id.225339 · Note