CVE-2023-1503

CWE-89 — SQL Injection3 documents3 sources

Severity

8.1HIGH

EPSS

0.2%

top 53.06%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Sourcecodester Alphaware Simple E-commerce System Alphaware - Simple E-commerce System Project Alphaware - Simple E-commerce System

Timeline

PublishedMar 20

Description

A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1.0. This affects an unknown part of the file admin/admin_index.php. The manipulation of the argument username/password with the input admin' AND (SELECT 8062 FROM (SELECT(SLEEP(5)))meUD)-- hLiX leads to sql injection. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the …

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 2.2 | Impact: 3.4

Affected Packages2 packages

▶CVEListV5sourcecodester/alphaware_simple_e-commerce_system1.0

▶NVDalphaware_-_simple_e-commerce_system_project/alphaware_-_simple_e-commerce_system1.0

🔴Vulnerability Details

CVEList

SourceCodester Alphaware Simple E-Commerce System admin_index.php sql injection↗2023-03-20

▶

GHSA

GHSA-gchv-f7pp-384g: A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1↗2023-03-20

▶