vendor:
Daily Expense Manager
by:
Stefan Hesselman
6.1
CVSS
HIGH
SQL Injection
89, 74
CWE
Product Name: Daily Expense Manager
Affected Version From: 1
Affected Version To: 1
Patch Exists: NO
Related CWE:
CPE: a:code-projects:daily_expense_manager:1.0
Platforms Tested: Kali Linux
2024
Daily Expense Manager 1.0 – ‘term’ SQL Injection
Daily Expense Manager 1.0 is vulnerable to SQL injection through the 'term' parameter in the readxp.php file. An attacker can inject malicious SQL queries via the 'term' parameter, leading to unauthorized access to the database.
Mitigation:
To mitigate this vulnerability, input validation and parameterized queries should be implemented to prevent SQL injection attacks. Sanitize user input and use prepared statements when interacting with databases.
