CVE-2023-0946
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A critical SQL Injection vulnerability in SourceCodester Best POS Management System 1.0. An unknown functionality in the file billing/index.php?id=9 allows manipulation of the id argument, leading to SQL injection. The attack can be launched remotely.
Risk Assessment
An attacker can exploit this to gain unauthorized access to the database, steal, modify, or delete data, and potentially take control of the system.
Recommendation
Apply patches provided by the vendor or restrict access to the billing/index.php file. It is also recommended to use parameterized queries and input validation.
Other vulnerabilities in Best POS Management System
See all- CVE-2023-27205Critical
Best POS Management System 1.0 contains a SQL injection vulnerability via the month parameter at /kruxton/sales_report.php.
- CVE-2023-27204Critical
Best POS Management System 1.0 contains a SQL injection vulnerability via the id parameter at /kruxton/manage_user.php.
- CVE-2023-27203Critical
Best POS Management System 1.0 contains a SQL injection vulnerability via the id parameter at /billing/home.php.
- CVE-2023-27202Critical
Best POS Management System 1.0 contains a SQL injection vulnerability in the id parameter at /kruxton/receipt.php. An attacker can exploit this flaw to manipulate database queries.
- CVE-2023-27206Medium
A cross-site scripting (XSS) vulnerability in /kruxton/navbar.php of Best POS Management System 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the page parameter.
Original NVD description (English source)
A vulnerability has been found in SourceCodester Best POS Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file billing/index.php?id=9. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The identifier VDB-221593 was assigned to this vulnerability.