CVE-2023-27204
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
Best POS Management System 1.0 contains a SQL injection vulnerability via the id parameter at /kruxton/manage_user.php.
Risk Assessment
An attacker can manipulate SQL queries, potentially leading to unauthorized data access or modification.
Recommendation
Use parameterized queries or input validation for the id parameter.
Other vulnerabilities in Best POS Management System
See all- CVE-2023-27205Critical
Best POS Management System 1.0 contains a SQL injection vulnerability via the month parameter at /kruxton/sales_report.php.
- CVE-2023-27203Critical
Best POS Management System 1.0 contains a SQL injection vulnerability via the id parameter at /billing/home.php.
- CVE-2023-27202Critical
Best POS Management System 1.0 contains a SQL injection vulnerability in the id parameter at /kruxton/receipt.php. An attacker can exploit this flaw to manipulate database queries.
- CVE-2023-27206Medium
A cross-site scripting (XSS) vulnerability in /kruxton/navbar.php of Best POS Management System 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the page parameter.
- CVE-2023-0946Medium
A critical SQL Injection vulnerability in SourceCodester Best POS Management System 1.0. An unknown functionality in the file billing/index.php?id=9 allows manipulation of the id argument, leading to SQL injection. The attack can be launched remotely.
Original NVD description (English source)
Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /kruxton/manage_user.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS