PT-2023-29086 · Unknown · Codecanyon Credit Lite

Skalvin · Published 2023-08-18 · Updated 2024-05-17 · CVE-2023-4407

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Codecanyon Credit Lite version 1.5.4

Description A critical vulnerability was found in the component POST Request Handler, specifically in the file /portal/reports/account statement. The manipulation of the date1 and date2 arguments leads to SQL injection. The attack can be launched remotely.

Recommendations For Codecanyon Credit Lite version 1.5.4, consider disabling the /portal/reports/account statement endpoint until a patch is available. Restrict access to the POST Request Handler component to minimize the risk of exploitation. Avoid using the date1 and date2 arguments in the affected endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-4407

Affected Products

Codecanyon Credit Lite

References · 9

• 🔥 http://packetstormsecurity.com/files/174244/Credit-Lite-1.5.4-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/51701 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-4407 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4407 · Vendor Advisory
• https://t.me/cvenotify/56854 · Telegram Post
• https://t.me/cibsecurity/68827 · Telegram Post
• https://vuldb.com/?id.237511 · Note
• https://t.me/cvenotify/56851 · Telegram Post
• https://vuldb.com/?ctiid.237511 · Note