SourceCodester Online Computer and Laptop Store sql injection

CVE-2023-1960

Summary

A notable vulnerability exists in the Online Computer and Laptop Store 1.0 software, specifically in the file /classes/Master.php?f=delete_category. This flaw allows an attacker to manipulate the 'id' argument, potentially leading to SQL injection attacks. Such vulnerabilities enable malicious actors to execute arbitrary SQL commands on the backend database, allowing unauthorized access, data leakage, or data manipulation. The exploit can be triggered remotely, exposing users and systems to significant security risks. Public disclosure of this vulnerability raises the urgency for affected users to take remediation measures promptly.

References