Paper/Archive/CVE-2023-1962

CVE-2023-1962

SourceCodester Best Online News Portal — SourceCodester Best Online News Portal POST Parameter forgot-password.php sql injection

EPSS 0.8%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 57.0.570 × 2011.4 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A vulnerability classified as critical was found in SourceCodester Best Online News Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/forgot-password.php of the component POST Parameter Handler. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225361 was assigned to this vulnerability.

Affected

ProductAffectedFixed inSource

Best Online News Portal1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

writeupvuldb.com/?id.225361 refvuldb.com/?ctiid.225361 exploitgithub.com/PEOIzEve/bug_report/blob/main/SQLi-1.md