CVE-2023-1908
SourceCodester Simple Mobile Comparison Website GET Parameter view_category.php sql injection
Published 3 y ago · modified 4 mo ago · JSON
Summary
A vulnerability was found in SourceCodester Simple Mobile Comparison Website 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/categories/view_category.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225150 is the identifier assigned to this vulnerability.
Exploit prediction (EPSS)
0.74% probability of exploitation in the next 30 days, higher than 55% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 6.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- SourceCodester Simple Mobile Comparison Website
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- vuldb.com /?id.225150 · vdb-entry, technical-description, x_transferred
- vuldb.com /?ctiid.225150 · signature, permissions-required, x_transferred
- github.com /Kerkong/bug_report/blob/main/SQLi-1.md · exploit, x_transferred
Sources
- CVE List: CVE-2023-1908
- NVD: CVE-2023-1908
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.