CVE-2023-1058 — SQL Injection in Doctors Appointment System

CWE-89 — SQL Injection4 documents4 sources
Severity
8.8HIGHNVD
CNA7.3
EPSS
0.3%
top 47.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Sourcecodester Doctors Appointment SystemDoctors Appointment System Project Doctors Appointment System
Timeline
PublishedFeb 27

Description

A vulnerability classified as critical has been found in SourceCodester Doctors Appointment System 1.0. This affects an unknown part of the file create-account.php. The manipulation of the argument newemail leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221823.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
CVEList
SourceCodester Doctors Appointment System create-account.php sql injection↗2023-02-27
▶
GHSA
GHSA-c73x-h54w-jq65: A vulnerability classified as critical has been found in SourceCodester Doctors Appointment System 1↗2023-02-27
▶

💥Exploits & PoCs

1
Nuclei
PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
▶
CVE-2023-1058 — SQL Injection | cvebase