Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

CVE-2023-49624

What is CVE-2023-49624?

Billing Software v1.0 from Kashipara is affected by multiple unauthenticated SQL injection vulnerabilities. Specifically, the 'cancelid' parameter of the material_bill.php resource lacks proper input validation, allowing attackers to send malicious SQL commands directly to the database. This vulnerability can potentially be exploited to manipulate database queries, leading to unauthorized access to sensitive information, data leakage, or other malicious activities. Users must address this issue promptly to prevent exploitation.

References