// For flags

CVE-2023-7107

code-projects E-Commerce Website user_signup.php sql injection

Severity Score

7.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

A vulnerability was found in code-projects E-Commerce Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file user_signup.php. The manipulation of the argument firstname/middlename/email/address/contact/username leads to sql injection. The attack may be launched remotely. VDB-249002 is the identifier assigned to this vulnerability.

Se encontró una vulnerabilidad en code-projects E-Commerce Website 1.0. Ha sido calificada como crítica. Una función desconocida del archivo user_signup.php es afectada por esta vulnerabilidad. La manipulación del argumento nombre/segundo nombre/correo electrónico/dirección/contacto/nombre de usuario conduce a la inyección de SQL. El ataque puede lanzarse de forma remota. VDB-249002 es el identificador asignado a esta vulnerabilidad.

Eine kritische Schwachstelle wurde in code-projects E-Commerce Website 1.0 ausgemacht. Dies betrifft einen unbekannten Teil der Datei user_signup.php. Mittels Manipulieren des Arguments firstname/middlename/email/address/contact/username mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren.

*Credits: Hamdi Sevben
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-12-25 CVE Reserved
  • 2023-12-25 CVE Published
  • 2023-12-26 EPSS Updated
  • 2024-08-14 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Code-projects
Search vendor "Code-projects"
E-Commerce Website
Search vendor "Code-projects" for product "E-Commerce Website"
1.0
Search vendor "Code-projects" for product "E-Commerce Website" and version "1.0"
en
Affected