OpenCVE

Dairy Farm Shop Management System Using PHP and MySQL v1.1 was discovered to contain multiple SQL injection vulnerabilities in the Login function via the Username and Password parameters.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
Phpgurukul	Dairy Farm Shop Management System

Configuration 1 [-]

cpe:2.3:a:phpgurukul:dairy_farm_shop_management_system:1.1:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/MATRIXDEVIL/CVE/blob/main/CVE-2023-41594
https://portswigger.net/web-security/sql-injection
https://www.acunetix.com/vulnerabilities/web/sql-injection/

History

Thu, 26 Sep 2024 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-09-08T00:00:00

Updated: 2024-09-26T17:46:34.786Z

Reserved: 2023-08-30T00:00:00

Link: CVE-2023-41594

Vulnrichment

Updated: 2024-08-02T19:01:35.380Z

NVD

Status : Modified

Published: 2023-09-08T03:15:08.997

Modified: 2024-11-21T08:21:19.890

Link: CVE-2023-41594

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phpgurukul:dairy_farm_shop_management_system:1.1:*:*:*:*:*:*:*", "matchCriteriaId": "A1EC8290-03A2-4AC6-922B-B469FBB0E453", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Dairy Farm Shop Management System Using PHP and MySQL v1.1 was discovered to contain multiple SQL injection vulnerabilities in the Login function via the Username and Password parameters."}, {"lang": "es", "value": "Se ha descubierto que Dairy Farm Shop Management System Using PHP and MySQL v1.1 contiene m\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en la funci\u00f3n de inicio de sesi\u00f3n a trav\u00e9s de los par\u00e1metros de nombre de usuario y contrase\u00f1a. "}], "id": "CVE-2023-41594", "lastModified": "2024-11-21T08:21:19.890", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-08T03:15:08.997", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "https://github.com/MATRIXDEVIL/CVE/blob/main/CVE-2023-41594"}, {"source": "cve@mitre.org", "tags": ["Technical Description"], "url": "https://portswigger.net/web-security/sql-injection"}, {"source": "cve@mitre.org", "tags": ["Technical Description"], "url": "https://www.acunetix.com/vulnerabilities/web/sql-injection/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://github.com/MATRIXDEVIL/CVE/blob/main/CVE-2023-41594"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Technical Description"], "url": "https://portswigger.net/web-security/sql-injection"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Technical Description"], "url": "https://www.acunetix.com/vulnerabilities/web/sql-injection/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}