CVE-2023-38890

Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling SQL Injection attacks.

The organization is at risk of unauthorized access to data and potential data manipulation, which can lead to loss of data integrity and reputation. Attackers may exploit this vulnerability to gain control over the system.

It is recommended to implement proper validation and sanitization mechanisms for user input in the login form to prevent SQL Injection attacks. A security audit of the application should also be conducted, and it should be updated to the latest version.