SourceCodester Online Graduate Tracer System search_it.php sql injection
CVE-2023-1309

9.8CRITICAL

Key Information:

Vendor

SourceCodester
Status
Online Graduate Tracer System
Vendor
CVE Published:
10 March 2023

What is CVE-2023-1309?

A security flaw exists in the SourceCodester Online Graduate Tracer System 1.0, where improper validation of user input in the admin/search_it.php file allows for SQL injection vulnerabilities. This enables attackers to manipulate input arguments, allowing for unauthorized access to the database and potential exposure of sensitive data. The vulnerability can be exploited remotely, increasing its risk to users. An identifier, VDB-222697, has been assigned to track this issue.

Affected Version(s)

Online Graduate Tracer System 1.0

References

https://vuldb.com/?id.222697
vdb-entrytechnical-description
https://vuldb.com/?ctiid.222697
signaturepermissions-required
https://github.com/gtest1112/111/blob/main/sqli-2.md
exploit

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

gtest112 (VulDB User)
.
CVE-2023-1309 : SourceCodester Online Graduate Tracer System search_it.php sql injection