CVE-2023-49666

Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'custmer_details' parameter of the submit_material_list.php resource does not validate the characters received and they are sent unfiltered to the database.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:kashipara:billing_system:1.0:*:*:*:*:*:*:*

History

21 Nov 2024, 08:33

Type Values Removed Values Added
References () https://fluidattacks.com/advisories/zimerman/ - Exploit, Third Party Advisory () https://fluidattacks.com/advisories/zimerman/ - Exploit, Third Party Advisory
References () https://www.kashipara.com/ - Product () https://www.kashipara.com/ - Product

10 Jan 2024, 01:13

Type Values Removed Values Added
References () https://fluidattacks.com/advisories/zimerman/ - () https://fluidattacks.com/advisories/zimerman/ - Exploit, Third Party Advisory
References () https://www.kashipara.com/ - () https://www.kashipara.com/ - Product
First Time Kashipara billing System
Kashipara
CPE cpe:2.3:a:kashipara:billing_system:1.0:*:*:*:*:*:*:*

04 Jan 2024, 14:58

Type Values Removed Values Added
New CVE

Information

Published : 2024-01-04 14:15

Updated : 2024-11-21 08:33


NVD link : CVE-2023-49666

Mitre link : CVE-2023-49666

CVE.ORG link : CVE-2023-49666


JSON object : View

Products Affected

kashipara

  • billing_system
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')