vendor:
Client Details System
by:
Hamdi Sevben
7.1
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Client Details System
Affected Version From: 1
Affected Version To: 1
Patch Exists: NO
Related CWE: CVE-2023-7137
CPE: a:code-projects:client_details_system:1.0
Platforms Tested: Windows 10 Pro + PHP 8.1.6, Apache 2.4.53
2023
Client Details System SQL Injection Vulnerability
Client Details System 1.0 is vulnerable to SQL Injection through the 'uemail' parameter in the '/clientdetails/' endpoint. An attacker can exploit this vulnerability to compromise the application, access or manipulate data, or target the underlying database for further exploitation.
Mitigation:
To mitigate this vulnerability, input validation and parameterized queries should be implemented to sanitize user inputs and prevent SQL Injection attacks.
