code-projects Client Details System HTTP POST Request regester.php sql injection
CVE-2023-7139

9.8CRITICAL

Key Information:

Vendor
code-projects
Status
Client Details System
Vendor
CVE Published:
28 December 2023

Summary

A SQL injection vulnerability has been identified in the Client Details System 1.0 by Code-Projects. This flaw resides in the file /admin/regester.php and is triggered by improper handling of the HTTP POST request parameters fname, lname, email, and contact. Attackers could potentially exploit this vulnerability to manipulate SQL queries, leading to unauthorized access or data leakage. The details of this vulnerability have been made public, and it is crucial for users of this system to apply patches or take preventative measures to secure their applications against potential attacks.

Affected Version(s)

Client Details System 1.0

References

https://vuldb.com/?id.249142
vdb-entrytechnical-description
https://vuldb.com/?ctiid.249142
signaturepermissions-required
https://github.com/h4md153v63n/CVEs/blob/main/Client_Deta...
exploit

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hamdi Sevben (VulDB User)
.
CVE-2023-7139 : code-projects Client Details System HTTP POST Request regester.php sql injection | SecurityVulnerability.io