SourceCodester Clinics Patient Management System update_user.php sql injection
CVE-2023-1035
8.8HIGH
Summary
A SQL injection vulnerability exists in the SourceCodester Clinics Patient Management System 1.0 due to improper handling of the user_id parameter in the update_user.php file. This issue allows an attacker to execute arbitrary SQL commands, which can potentially compromise the database. The vulnerability can be exploited remotely, creating a significant security risk. Users are advised to apply patches or updates provided by the vendor to mitigate the risk associated with this SQL injection vulnerability.
Affected Version(s)
Clinics Patient Management System 1.0
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)