SourceCodester Best Online News Portal POST Parameter forgot-password.php sql injection
CVE-2023-1962
Key Information:
- Vendor
- Sourcecodester
- Status
- Vendor
- CVE Published:
- 9 April 2023
Badges
Summary
A vulnerability exists in the Best Online News Portal 1.0 due to improper handling of the 'username' parameter in the /admin/forgot-password.php file. This flaw allows an attacker to manipulate the POST request and perform SQL injection, potentially gaining unauthorized access to sensitive data. The exploit can be executed remotely, posing significant security risks to users of the affected product. Awareness of this vulnerability is crucial due to its public disclosure, making it essential for administrators to implement protective measures promptly.
Affected Version(s)
Best Online News Portal 1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved