CVE-2023-3859
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A critical vulnerability was found in phpscriptpoint Car Listing version 1.6, affecting unknown processing of the /search.php file of the GET Parameter Handler component. Manipulation of arguments such as brand_id, model_id, car_condition, car_category_id, body_type_id, fuel_type_id, transmission_type_id, year, mileage_start, mileage_end, country, state, city leads to SQL injection.
Risk Assessment
An attacker may remotely exploit this vulnerability, posing a serious threat to data security within the system.
Recommendation
It is recommended to immediately update the software to the latest version or apply appropriate security patches to minimize the risk of an attack.
Original NVD description (English source)
A vulnerability was found in phpscriptpoint Car Listing 1.6 and classified as critical. This issue affects some unknown processing of the file /search.php of the component GET Parameter Handler. The manipulation of the argument brand_id/model_id/car_condition/car_category_id/body_type_id/fuel_type_id/transmission_type_id/year/mileage_start/mileage_end/country/state/city leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-235211. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.