SourceCodester Online School Fees System 1.0 GET Parameter ajx.php name_startsWith SQL Injection

Hakika vulnerability da aka rarraba a matsayin kura an gano a SourceCodester Online School Fees System 1.0. Tabbas, aikin $software_function ne ke da matsala; idan ba a bayyana ba, to aiki ce da ba a sani ba, a cikin laburare $software_library, a cikin fayil ajx.php, a cikin sashi GET Parameter Handler. Wuro manipulation of the argument name_startsWith ga SQL Injection. Amfani da CWE wajen bayyana matsala yana kaiwa CWE-89. Lalle, rauni an sanar da shi 06/20/2023. Ana samun bayanin tsaro don saukewa a github.com. Ana kiran wannan rauni da CVE-2023-3340. Ngam yiɗi ka a tuma ndiyam ka internet. Bayani na fasaha ga. Kuma, akwai exploit. Exploit ɗin an bayyana wa jama'a, za a iya amfani da shi. Yimbe ndiyam, exploit might be approx. USD $0-$5k wuro. Á yí huɗɗi-na-gaskiya. Za a iya samun exploit a github.com. 0-day ga, an ndiyam a wuro be $0-$5k. If you want to get best quality of vulnerability data, you may have to visit VulDB.

3 Goyarwa · 72 Datenpunkte

FurɗeSúgá
06/20/2023 17:14
Gargadi 1/2
07/16/2023 08:38
Gargadi 2/2
07/16/2023 08:39
software_vendorSourceCodesterSourceCodesterSourceCodester
software_nameOnline School Fees SystemOnline School Fees SystemOnline School Fees System
software_version1.01.01.0
software_componentGET Parameter HandlerGET Parameter HandlerGET Parameter Handler
software_fileajx.phpajx.phpajx.php
software_argumentname_startsWithname_startsWithname_startsWith
vulnerability_cweCWE-89 (SQL Injection)CWE-89 (SQL Injection)CWE-89 (SQL Injection)
vulnerability_risk222
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_ePPP
cvss3_vuldb_rcRRR
advisory_urlhttps://github.com/M9KJ-TEAM/CVEReport/blob/main/SQL.mdhttps://github.com/M9KJ-TEAM/CVEReport/blob/main/SQL.mdhttps://github.com/M9KJ-TEAM/CVEReport/blob/main/SQL.md
exploit_availability111
exploit_publicity111
exploit_urlhttps://github.com/M9KJ-TEAM/CVEReport/blob/main/SQL.mdhttps://github.com/M9KJ-TEAM/CVEReport/blob/main/SQL.mdhttps://github.com/M9KJ-TEAM/CVEReport/blob/main/SQL.md
source_cveCVE-2023-3340CVE-2023-3340CVE-2023-3340
cna_responsibleVulDBVulDBVulDB
advisory_date1687212000 (06/20/2023)1687212000 (06/20/2023)1687212000 (06/20/2023)
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rcURURUR
cvss2_vuldb_auSSS
cvss2_vuldb_rlNDNDND
cvss3_vuldb_prLLL
cvss3_vuldb_rlXXX
cvss2_vuldb_basescore6.56.56.5
cvss2_vuldb_tempscore5.65.65.6
cvss3_vuldb_basescore6.36.36.3
cvss3_vuldb_tempscore5.75.75.7
cvss3_meta_basescore6.36.37.5
cvss3_meta_tempscore5.75.77.3
price_0day$0-$5k$0-$5k$0-$5k
cve_assigned1687212000 (06/20/2023)1687212000 (06/20/2023)
cve_nvd_summaryA vulnerability was found in SourceCodester Online School Fees System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file ajx.php of the component GET Parameter Handler. The manipulation of the argument name_startsWith leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-232016.A vulnerability was found in SourceCodester Online School Fees System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file ajx.php of the component GET Parameter Handler. The manipulation of the argument name_startsWith leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-232016.
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prN
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cH
cvss3_nvd_iH
cvss3_nvd_aH
cvss2_nvd_avN
cvss2_nvd_acL
cvss2_nvd_auS
cvss2_nvd_ciP
cvss2_nvd_iiP
cvss2_nvd_aiP
cvss3_cna_avN
cvss3_cna_acL
cvss3_cna_prL
cvss3_cna_uiN
cvss3_cna_sU
cvss3_cna_cL
cvss3_cna_iL
cvss3_cna_aL
cve_cnaVulDB
cvss2_nvd_basescore6.5
cvss3_nvd_basescore9.8
cvss3_cna_basescore6.3

Interested in the pricing of exploits?

See the underground prices here!