vendor:
Client Details System
by:
Hamdi Sevben
7.1
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Client Details System
Affected Version From: 1
Affected Version To: 1
Patch Exists: NO
Related CWE: CVE-2023-7137
CPE: a:client_details_system:client_details_system:1.0
Platforms Tested: Windows 10 Pro + PHP 8.1.6, Apache 2.4.53
2023
SQL Injection in Client Details System 1.0
Client Details System 1.0 is vulnerable to SQL Injection through the 'uemail' parameter in the '/clientdetails/' endpoint. An attacker can exploit this vulnerability to compromise the application, access or manipulate data, or leverage other vulnerabilities in the database.
Mitigation:
To mitigate this vulnerability, input validation and parameterized queries should be implemented to prevent untrusted data from being directly used in SQL queries.