by Kastro
Paper/Archive/CVE-2023-7081

CVE-2023-7081

POSTAHSİL Online Payment System — SQLi in PosTahsil's Online Payment System

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.1.441 × 208.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSTAHSİL Online Payment System allows SQL Injection. This issue affects Online Payment System: before 14.02.2024.

Affected

ProductAffectedFixed inSource
Online Payment System< 14.02.202414.02.2024CNA
online_payment_system< 14.02.202414.02.2024CISA-ADP

Scores by source

TR-CERT (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-24-0103refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0103