SQL Injection Vulnerability in Sourcecodester Customer Support System
CVE-2023-50070

8.8HIGH

Key Information:

Vendor

Oretnom23

Status
Customer Support System
Vendor
CVE Published:
29 December 2023

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2023-50070?

The Sourcecodester Customer Support System version 1.0 is vulnerable to multiple SQL injection attacks through the '/customer_support/ajax.php?action=save_ticket' endpoint. The parameters 'department_id', 'customer_id', and 'subject' can be exploited to manipulate database queries, potentially allowing an attacker to access sensitive data or execute unauthorized commands on the database. This vulnerability poses significant risks to the integrity and confidentiality of the information stored in the customer support system.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-50070
Created by geraldoalcantara

References

https://github.com/geraldoalcantara/CVE-2023-50070
https://medium.com/%40geraldoalcantarapro/cve-2023-50070-...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.