CVE-2023-2346 — SQL Injection in Service Provider Management System

CWE-89 — SQL InjectionCWE-476 — NULL Pointer Dereference6 documents6 sources
Severity
9.8CRITICALNVD
CNA6.3
EPSS
0.1%
top 79.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Sourcecodester Service Provider Management SystemOretnom23 Service Provider Management System
Timeline
PublishedApr 27
Latest updateDec 30

Description

A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227589 was assigned to this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

3
OSV
vduse: fix NULL pointer dereference↗2025-12-30
▶
GHSA
GHSA-cx8g-ghpg-3w35: A vulnerability was found in SourceCodester Service Provider Management System 1↗2023-04-27
▶
CVEList
SourceCodester Service Provider Management System view_inquiry.php sql injection↗2023-04-27
▶
CVE-2023-2346 — SQL Injection | cvebase