SourceCodester Alphaware Simple E-Commerce System edit_customer.php sql injection

CVE-2023-1502

Summary

A vulnerability exists in the SourceCodester Alphaware Simple E-Commerce System 1.0 that allows for SQL injection attacks via the manipulation of parameters in the file function/edit_customer.php. Specifically, an attacker can exploit this flaw by injecting SQL commands into the firstname, mi, or lastname fields using a crafted input. This attack can be executed remotely, making it particularly concerning for users of the affected system. While the complexity of launching such an attack is relatively high, the potential for exploitation poses a serious risk to the integrity and confidentiality of the database.

References