CVE-2023-49641: critical vulnerability in Kashipara Group Billing Software
Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 0.4%
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the loginCheck.php resource does not validate the characters received and they are sent unfiltered to the database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Kashipara Group · Billing SoftwareRelated CVEs — Kashipara Group Billing Software
In the same product, most dangerous first.
CVE-2023-49666CRITICALBilling Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%CVE-2023-49665CRITICALBilling Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%CVE-2023-49658CRITICALBilling Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%CVE-2023-49639CRITICALBilling Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%CVE-2023-49633CRITICALBilling Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%CVE-2023-49625CRITICALBilling Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)EPSS 0.7%