CVE-2023-38890
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling SQL Injection attacks.
Online Shopping Portal Project v3.1 permite a atacantes remotos ejecutar comandos/consultas SQL arbitrarias a través del formulario de inicio de sesión, lo que conduce a un acceso no autorizado y a una posible manipulación de los datos. Esta vulnerabilidad surge debido a la insuficiente validación de entrada proporcionada por el usuario en el campo de nombre de usuario, lo que permite ataques de inyección SQL.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2023-07-25 CVE Reserved
- 2023-08-18 CVE Published
- 2024-10-07 CVE Updated
- 2024-10-07 First Exploit
- 2024-11-22 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://github.com/akshadjoshi/CVE-2023-38890 | 2024-10-07 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Phpgurukul Search vendor "Phpgurukul" | Online Shopping Portal Search vendor "Phpgurukul" for product "Online Shopping Portal" | 3.1 Search vendor "Phpgurukul" for product "Online Shopping Portal" and version "3.1" | - |
Affected
|