Campcodes Beauty Salon Management System del_category.php sql injection
CVE-2023-3879

7.5HIGH

Key Information:

Vendor
Campcodes
Status
Beauty Salon Management System
Vendor
CVE Published:
25 July 2023

Summary

A SQL injection vulnerability exists in the Campcodes Beauty Salon Management System 1.0, specifically affecting the processing of the /admin/del_category.php file. An attacker can manipulate the 'id' argument, which may lead to unauthorized access to the database. This remote exploit compromises data integrity, making it a serious concern for any deployment of the system. Users are advised to apply necessary updates and monitor system security closely to mitigate potential attacks.

Affected Version(s)

Beauty Salon Management System 1.0

References

https://vuldb.com/?id.235241
vdb-entrytechnical-description
https://vuldb.com/?ctiid.235241
signaturepermissions-required
https://github.com/E1CHO/cve_hub/blob/main/Beauty%20Salon...
exploit

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (VulDB User)
.
CVE-2023-3879 : Campcodes Beauty Salon Management System del_category.php sql injection | SecurityVulnerability.io