CVE-2023-1987 — SQL Injection in Online Computer AND Laptop Store

CWE-89 — SQL InjectionCWE-99 — Resource Injection4 documents4 sources
Severity
7.2HIGHNVD
CNA6.3
EPSS
0.4%
top 38.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Sourcecodester Online Computer AND Laptop StoreOretnom23 Online Computer AND Laptop Store
Timeline
PublishedApr 11
Latest updateApr 4

Description

A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is the function update_order_status of the file /classes/Master.php?f=update_order_status. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225535.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
CVEList
SourceCodester Online Computer and Laptop Store update_order_status sql injection↗2023-04-11
▶
GHSA
GHSA-fm2p-2389-9hc9: A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1↗2023-04-11
▶

📋Vendor Advisories

1
Red Hat
kernel: dmaengine: idxd: Ensure safe user copy of completion record↗2024-04-04
▶
CVE-2023-1987 — SQL Injection | cvebase