PT-2023-22703 · Unknown · Medicine Tracker System

D34Dun1C02N + 1 · Published 2023-04-24 · Updated 2023-05-02 · CVE-2023-30458

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Medicine Tracker System version 1.0

Description A username enumeration issue was discovered in the login functionality, allowing a malicious user to guess a valid username due to a different response time from invalid usernames. When a valid username is entered, the response time increases depending on the length of the supplied password.

Recommendations For Medicine Tracker System version 1.0, consider implementing a rate-limiting mechanism or a constant response time to prevent username enumeration. Additionally, restrict access to the login functionality to minimize the risk of exploitation.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2023-30458

Affected Products

Medicine Tracker System

References · 6

• 🔥 https://github.com/d34dun1c02n/CVE-2023-30458 · Exploit
• https://osv.dev/vulnerability/CVE-2023-30458 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30458 · Security Note
• https://t.me/cvenotify/48919 · Telegram Post
• https://sourcecodester.com/php/16308/medicine-tracker-system-php-oop-and-mysql-db-source-code-free-download.html · Note
• https://sourcecodester.com/download-code?nid=16308&title=Medicine+Tracker+System+in+PHP+%28OOP%29+and+MySQL+DB+Source+Code+Free+Download · Note