SourceCodester Electronic Medical Records System Cookie administrator.php sql injection
CVE-2023-1151

9.8CRITICAL

Key Information:

Vendor

SourceCodester
Status
Electronic Medical Records System
Vendor
CVE Published:
2 March 2023

What is CVE-2023-1151?

A vulnerability exists in the SourceCodester Electronic Medical Records System 1.0 in the 'administrator.php' file related to the Cookie Handler component. This flaw allows attackers to manipulate the 'userid' argument, potentially leading to SQL injection conditions. As the vulnerability can be remotely exploited, it poses serious security risks to any deployment. Public disclosure of the exploit increases urgency for affected users to apply corrective measures.

Affected Version(s)

Electronic Medical Records System 1.0

References

https://vuldb.com/?id.222163
vdb-entrytechnical-description
https://vuldb.com/?ctiid.222163
signaturepermissions-required
https://github.com/lcg-22266/bug_report/blob/main/vendors...
exploit

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lcg22266 (VulDB User)
.