PT-2023-24397 · Sourcecodester · Sourcecodester Enrollment System Project

Sudovivek + 1 · Published 2023-06-21 · Updated 2024-08-01 · CVE-2023-33584

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Enrollment System Project version V1.0

Description The issue concerns SQL Injection (SQLI) attacks, which allow an attacker to manipulate the SQL queries executed by the application. This is due to the application's failure to properly validate user-supplied input in the username and password fields during the login process, enabling an attacker to inject malicious SQL code.

Recommendations For Sourcecodester Enrollment System Project version V1.0, consider implementing proper input validation and sanitization for the username and password fields to prevent SQL injection attacks. As a temporary workaround, restrict access to the login functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-33584

Affected Products

Sourcecodester Enrollment System Project

References · 10

• 🔥 http://packetstormsecurity.com/files/172718/Enrollment-System-Project-1.0-Authentication-Bypass-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/51501 · Exploit
• 🔥 https://github.com/sudovivek/CVE/blob/main/CVE-2023-33584/CVE-2023-33584.txt · Exploit
• 🔥 https://github.com/sudovivek/My-CVE/blob/main/CVE-2023-33584_exploit.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-33584 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33584 · Vendor Advisory
• https://t.me/cvenotify/52788 · Telegram Post
• https://t.me/cvenotify/77695 · Telegram Post
• https://sourcecodester.com/php/14444/enrollment-system-project-source-code-using-phpmysql.html · Note
• https://packetstormsecurity.com/files/cve/CVE-2023-33584 · Note