SourceCodester Young Entrepreneur E-Negosyo System sql injection
CVE-2023-1736

8.8HIGH

Key Information:

Vendor
SourceCodester
Status
Young Entrepreneur E-Negosyo System
Vendor
CVE Published:
30 March 2023

Summary

A significant SQL injection vulnerability has been identified in the Young Entrepreneur E-Negosyo System, specifically within the file cart/controller.php through the 'add' action. The vulnerability arises from improper handling of the 'PROID' argument, which allows an attacker to manipulate SQL queries, potentially leading to unauthorized data access and compromise of the database integrity. This flaw emphasizes the necessity for robust input validation and security measures in web applications.

Affected Version(s)

Young Entrepreneur E-Negosyo System 1.0

References

https://vuldb.com/?id.224624
vdb-entrytechnical-description
https://vuldb.com/?ctiid.224624
signaturepermissions-required
https://www.sourcecodester.com/php/12684/young-entreprene...
related

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

WWesleywww (VulDB User)
.