CVE-2023-1506 MEDIUM

CVE-2023-1506: SourceCodester E-Commerce System login.php sql injection

Vendor Sourcecodester
Product E-Commerce System
Weakness CWE-89 · SQLi
Published March 20, 2023
Last update August 2, 2024

CVSS base score

5.6/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability, which was classified as critical, was found in SourceCodester E-Commerce System 1.0. Affected is an unknown function of the file login.php. The manipulation of the argument U_USERNAME leads to sql injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. VDB-223410 is the identifier assigned to this vulnerability.

Key dates

02Disclosure timeline

March 20, 2023 CVE published
August 2, 2024 Record updated