CVE-2023-3985highCWE-89

CVE-2023-3985: high-severity vulnerability in SourceCodester Online Jewelry Store

SourceCodester Online Jewelry Store login.php sql injection

Published 28 Jul 2023 · Updated 02 Aug 2024

Follow this CVE + Monitor Online Jewelry Store

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3epss 0.9%

A vulnerability has been found in SourceCodester Online Jewelry Store 1.0 and classified as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235606 is the identifier assigned to this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

SourceCodester · Online Jewelry Store

Related CVEs — SourceCodester Online Jewelry Store

In the same product, most dangerous first.

CVE-2023-2815MEDIUMSourceCodester Online Jewelry Store POST Parameter supplier.php sql injectionEPSS 0.7%CVE-2023-2864LOWSourceCodester Online Jewelry Store POST Parameter customer.php cross site scriptingEPSS 0.5%

References

https://github.com/MaxLiu98/Jewelry-Store-System/blob/main/Jewelry%20Store%20System%20login.php%20has%20Sqlinjection.pdf https://vuldb.com/?ctiid.235606 https://vuldb.com/?id.235606